California Establishes Strike Force to Police Data Brokers

Key Takeaways

• New Enforcement Strike Force: CalPrivacy has created a dedicated unit to investigate privacy violations and assess data broker compliance with the CCPA and the Delete Act.
• Built on 2024 Investigative Sweep: The Strike Force expands the agency’s ongoing review into whether data brokers registered as required under the Delete Act, which has already produced a record number of enforcement actions.
• Officials Warn of Heightened Risks: CalPrivacy leaders say industrial-scale data collection creates significant risks for consumers, including misuse of personal information and vulnerability to data breaches.
• Registration Fees Fund New Tools: Delete Act registration fees support the California Data Broker Registry and development of DROP, a statewide mechanism for consumers to request deletion of their data across all brokers.
• DROP Launches January 2026: The Delete Request and Opt-Out Platform will allow Californians to instruct every registered data broker to delete their personal information through a single request.

Deep Dive

California’s privacy regulator is sharpening its focus on the data broker industry, creating a new enforcement strike force to investigate how companies collect, sell, and manage personal information across the state. The effort marks one of the agency’s most concentrated pushes yet to bring more visibility, and accountability, to a sector often operating out of public sight.

The California Privacy Protection Agency said the new Data Broker Enforcement Strike Force will sit within its Enforcement Division and will conduct investigations tied to both the state’s comprehensive privacy law, the California Consumer Privacy Act (CCPA), and the new Delete Act, which requires data brokers to register with the state.

The move comes as the agency continues a broad review launched in 2024 that examined whether data brokers were registering as required under the Delete Act. That sweep has already produced what the agency describes as a record number of enforcement actions, and it remains active. The new strike force, officials said, allows them to expand that work with more dedicated staff and investigative bandwidth.

Michael Macko, who leads enforcement for the agency, said the approach borrows from long-standing investigative models used by federal and state prosecutors.

“For decades, strike forces have been a mainstay at U.S. Attorney offices and state Attorney General offices across the United States. We intend to bring the same level of intensity to our investigations into the data broker industry,” he said.

Executive director Tom Kemp underscored why the agency is devoting additional resources to the space. He pointed to the scale of personal information collected and traded by data brokers, describing a system where digital profiles can be widely circulated, misused, or exposed through data breaches.

“Data brokers pose unique risks to Californians through the industrial-scale collection and sale of our personal information,” he said. “The widespread availability of digital dossiers makes it easier for our personal information to be weaponized against us, and even well-meaning data brokers can be victims of data breaches that leave all of us vulnerable.”

Under the Delete Act, data brokers must register annually and pay fees that help fund the California Data Broker Registry. Those fees also support development of a statewide deletion system (the Delete Request and Opt-Out Platform, or DROP) that will allow consumers to instruct every registered data broker to delete their data in a single request. DROP is expected to become available in January 2026.

By establishing a dedicated strike force ahead of DROPs launch, the agency is saying that it intends to intensify compliance checks and accelerate ongoing investigations. Officials say the aim is to reduce risks tied to large-scale data collection while giving Californians a clearer window into how their information moves through the marketplace.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.