CalPrivacy (the California Privacy Protection Agency) issued Enforcement Advisory 2026-01 warning data brokers that providing incorrect information in their annual registration with California's data broker registry carries liability of a $200 fine per day. The advisory observes that the Enforcement Division has already brought multiple enforcement actions over reporting errors, and emphasizes that accurate registry disclosures are what make the newly launched Delete Request and Opt-Out Platform (DROP) work for Californians. No specific company was named and no penalty was imposed by the advisory itself; it functions as forward-looking guidance.
The advisory itself imposes no remedies on any entity. It cautions that data brokers are liable for a $200 fine for each day they fail to register as required by the Delete Act's reporting provisions, and notes the Enforcement Division has brought multiple enforcement actions over reporting errors. Consumers are encouraged to report incorrect registrations via the agency's complaint form.
Because this advisory signals that CalPrivacy will penalize inaccurate Delete Act registrations at $200 per day, in-house teams at companies that qualify as data brokers (or that buy, sell, or license personal data) should verify that their annual California data broker registry submissions are accurate - including reported metrics, types of data collected, and categories of data recipients - and reconcile those public disclosures against what their vendor, data supply, and customer agreements actually cover. Data licensing and vendor agreements should include representations and warranties that counterparties are properly registered data brokers that report accurately to CalPrivacy, covenants to honor DROP (Delete Request and Opt-Out Platform) deletion and opt-out requests, and audit rights to confirm registry disclosures match actual data flows. Marketing and data resale contracts should also be reviewed for onward-sharing or recipient terms that could contradict what is disclosed in the registry, since any mismatch now carries daily fine exposure.
Entity
Data brokers (unspecified - advisory applies to all businesses registered with California's data broker registry)
Industry
Data BrokerOfficial Press Release
https://privacy.ca.gov/2026/09/enforcement-advisory-targets-incorrect-information-in-data-broker-registration/
Enforcement Advisory No. 2026 01 Accuracy of Data Broker Reg
https://privacy.ca.gov/wp-content/uploads/sites/357/2026/09/Enforcement-Advisory-No.-2026-01-Accuracy-of-Data-Broker-Registration-Information.pdf
California Privacy Protection Agency Enforcement Page
https://cppa.ca.gov/enforcement/
"September 3, 2026"
"Enforcement Advisory Targets Incorrect Information in Data Broker Registration"
"CalPrivacy has issued Enforcement Advisory 2026-01"
"highlighting data brokers who provide incorrect information in their annual registration with California’s data broker registry"
"Data brokers are liable for a $200 fine for each day they fail to register “as required by” the Delete Act’s reporting provisions."
"The advisory stresses that data brokers are liable to pay a fine for each day incorrect information appears in the registry, observing that the Enforcement Division has brought multiple enforcement actions over reporting errors."
$36K
The California Privacy Protection Agency Board issued a Decision and Final Stipulated Order requiring Virginia-based data broker SalesIntel Research, Inc. to pay a $36,400 fine for operating as a data broker without registering by the 2025 deadline under the Delete Act. SalesIntel sells consumer personal information, including more than 200 million professional contacts and de-anonymized website traffic data, for targeted advertising. In addition to the fine, the company must post privacy rights metrics on its website, integrate with CalPrivacy's Delete Request and Opt-out Platform (DROP), and process future deletion requests through that system.
The California Privacy Protection Agency announced that more than 500,000 Californians have registered for the Delete Request and Opt-out Platform (DROP) since its January 1, 2026 launch. After the August 1, 2026 deadline for brokers to begin processing requests, 654 data brokers are in the system and approximately 25% have reported processing deletion requests, with tens of millions of records already deleted. No enforcement action has been announced yet; the agency warned that brokers who fail to delete eligible personal information face significant fines.
$52K
The California Privacy Protection Agency Board issued an Order of Decision and Stipulated Final Order requiring Boston-based data broker Cybba, Inc. to pay a $52,400 fine for failing to register with the Agency's Data Broker Registry by the 2025 deadline, as required by the Delete Act. The order also requires Cybba to post metrics about privacy rights on its website, access the Agency's Delete Request and Opt-Out Platform (DROP), and process future deletion requests through that system. This is CalPrivacy's second data broker enforcement action announced in less than a week, following its action against LocateSmarter.
$116K
The California Privacy Protection Agency Board issued a decision and stipulated order requiring Iowa data broker LocateSmarter LLC to pay $116,490 and change its practices. The company failed to timely register as a data broker and unlawfully required Californians to provide the last four digits of their Social Security numbers before exercising opt-out rights, violating the CCPA's data minimization requirements. This is the first action against a data broker under both the CCPA and the Delete Act.
The California Privacy Protection Agency announced that over 300,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP) since its launch five months ago. The Data Broker Registry now includes 581 registered data brokers, the highest number since the registry was established in 2020. Beginning August 1, 2026, all data brokers will be required to access DROP and process deletion requests.
$12.8M
CalPrivacy and the California Attorney General secured a $12.75 million settlement from General Motors for data sharing practices from connected vehicles. The settlement includes injunctive terms to change business practices.