The California Privacy Protection Agency (CPPA) announced an investigative sweep to enforce data broker registration compliance under the Delete Act. Data brokers must register annually and pay fees, with penalties of $200 per day for non-compliance. The CPPA will take enforcement actions against unregistered data brokers and is developing a consumer deletion platform (DROP) for 2026.
Data brokers must register with the CPPA by January 31 each year and pay the required annual fee. They must disclose deletion request metrics, report on collection of minors' data, reproductive healthcare data, and precise geolocation data, and provide a link to consumer rights information. Non-compliance incurs a $200 per day penalty that the CPPA will seek to recover.
In-house legal teams should review all agreements where their company acts as a data broker (selling personal information without a direct consumer relationship) or engages data brokers as vendors. Key clauses to examine include: (1) registration and annual fee payment obligations under the Delete Act; (2) procedures for handling consumer deletion requests, especially in anticipation of the 2026 DROP platform; (3) requirements to disclose collection of sensitive data (minors, reproductive health, precise geolocation) and report average response times; (4) mandates to include a CCPA rights link on relevant websites. Contracts may need amendments to explicitly allocate Delete Act compliance responsibilities, establish fee payment protocols, and integrate deletion request workflows that satisfy both current CCPA and future DROP requirements.
Entity
Data brokers
Also known as: Data Brokers
Industry
Data BrokerThe California Privacy Protection Agency announced that over 300,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP) since its launch five months ago. The Data Broker Registry now includes 581 registered data brokers, the highest number since the registry was established in 2020. Beginning August 1, 2026, all data brokers will be required to access DROP and process deletion requests.
The California Privacy Protection Agency launched a statewide roadshow to promote its Delete Request and Opt-out Platform (DROP), which allows California residents to request deletion of their personal information from all registered data brokers in a single request. The roadshow aims to increase awareness of data privacy rights and the DROP tool, which data brokers are legally required to process starting August 1, 2026.
$376K
The California Privacy Protection Agency settled with Ford Motor Company for $375,703 after finding that Ford violated the CCPA by requiring email verification for opt-out requests, creating unnecessary friction. Ford must implement easier opt-out methods, conduct a website audit, and comply with global privacy controls.
$1.1M
The California Privacy Protection Agency settled with PlayOn Sports for $1.10 million over CCPA violations, including failing to provide adequate opt-out mechanisms and improperly tracking users, particularly students. The company must implement proper opt-out methods, improve disclosures, and comply with children's data consent requirements.
The California Privacy Protection Agency (CalPrivacy) announced the appointment of Sabrina Boyson Ross as its first Chief Privacy Auditor and the formation of a new Audits Division. The division will conduct regulatory examinations of businesses to determine compliance with the California Consumer Privacy Act, and its findings may lead to enforcement referrals.
$45K
Datamasters, a data broker, failed to register with the California Data Broker Registry as required by the Delete Act. The company sold sensitive personal information including health conditions, age, race, and political views. As a result, it must pay a $45,000 fine and cease all sales of Californians' personal information.