CalPrivacy Data Broker Registration Enforcement Advisory

CA CPPA Newsroom

Published December 17th, 2025

Detected February 27th, 2026

Summary

CalPrivacy has issued an enforcement advisory reminding data brokers of their registration requirements, including disclosing trade names and websites, and registering independently. Data brokers must register by January 31 annually and face fines of $200 per day for non-compliance.

View original document View source feed page

What changed

CalPrivacy has issued Enforcement Advisory No. 2025-01, clarifying data broker registration requirements under California's Delete Act. The advisory emphasizes the need for data brokers to disclose all trade names and website addresses through which they operate and to register independently, rather than relying on a parent company's registration. This action highlights the agency's focus on ensuring transparency and accountability within the data broker industry, especially with the upcoming January 31st registration deadline.

Data brokers that fail to comply with these registration requirements face administrative fines of $200 per day, in addition to any registration fees and expenses incurred by CalPrivacy. The advisory serves as a critical reminder for businesses operating as data brokers to ensure their registration is accurate and complete before the deadline to avoid penalties and potential enforcement actions. Compliance officers should review their company's current registration status and disclosures to ensure adherence to these requirements.

What to do next

Review data broker registration details for accuracy, including trade names and websites.
Ensure independent registration for all entities operating as data brokers.
Submit annual registration and fees by January 31, 2026.

Penalties

Administrative fines of $200 per day, plus registration fees and expenses.

Source document (simplified)

Newsroom

CalPrivacy Issues Enforcement Advisory Highlighting Data Broker Registration

December 17, 2025

SACRAMENTO, CA — CalPrivacy has issued Enforcement Advisory No. 2025-01, addressing data broker registration requirements related to trade names, websites, and parent or subsidiary relationships.

Data brokers operate in a billion-dollar industry collecting and selling consumers’ personal information. Under California’s Delete Act, businesses that operated as data brokers in the prior year must register with the agency by January 31 each year, disclose certain information, and pay an annual fee that funds CalPrivacy’s Data Broker Registry. Those fees also fund a first-of-its-kind deletion mechanism, called the Delete Request and Opt-Out Platform (DROP), which will allow consumers to direct all registered data brokers to delete their personal information with a single request. DROP will be available to consumers January 1, 2026.

According to the advisory, some data brokers may be making it difficult for consumers to identify them by using trade names or websites that do not appear on their annual registration. The advisory highlights the requirement that data brokers disclose all trade names and website addresses through which they provide services. It also emphasizes that data brokers must register independently, rather than pointing to a parent company’s or affiliated entity’s registration.

Data brokers that fail to register face administrative fines of $200 per day in addition to registration fees and expenses CalPrivacy incurs in pursuing the case.

“The rules of the road are clear, and we expect data brokers will register as required,” said Michael Macko, CalPrivacy’s head of enforcement. “We will continue using all available tools to investigate potential violations and bring enforcement actions where appropriate.”

“We want to make it as easy as possible for Californians to exercise their privacy rights,” said Tom Kemp, CalPrivacy’s Executive Director. “With the next registration deadline around the corner, this advisory serves as a reminder for data brokers to register before they hear from us.”

CalPrivacy issues periodic enforcement advisories on aspects of the California Consumer Privacy Act and the Delete Act. These advisories provide observations from the Enforcement Division to help educate the public and businesses about their rights and responsibilities.

If consumers think a business is operating as an unregistered data broker, they should report it via the agency’s complaint form. Californians can also learn more about their rights and how to exercise those rights at Privacy.ca.gov.

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California’s cutting-edge privacy laws. Recent actions include:

Requiring ROR Partners LLC, a Nevada-based marketing firm catering to fitness and wellness brands, to pay $56,600 in fines and past-due fees for failing to register as a data broker. The case was brought as part of CalPrivacy’s Data Broker Enforcement Strike Force.
Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35 million fine and change its business practices for CCPA violations.
Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
Bringing a half-dozen enforcement actions against additional unregistered data brokers.
Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt-Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.