Data Brokers Face Renewed Scrutiny from California Before Registration Deadline

Key Takeaways

• Registration Obligations Are Firm: Data brokers must register annually with CalPrivacy by January 31 if they operated as data brokers in the prior year.
• Trade Names and Websites Matter: All trade names and service-related websites must be disclosed in registration filings.
• Each Broker Must Register Separately: Parent or affiliate registrations do not substitute for independent registration.
• DROP Launches in 2026: California’s one-stop deletion and opt-out platform goes live January 1, 2026.
• Daily Fines Can Accumulate Quickly: Failure to register can result in penalties of $200 per day, plus additional costs.

Deep Dive

California is zoning in on data brokers that may be obscuring their identities or relying on corporate affiliations to sidestep registration requirements, as a new consumer deletion platform prepares to go live in 2026.

CalPrivacy has recently issued Enforcement Advisory No. 2025-01, outlining expectations for how data brokers must register under the state’s Delete Act, particularly when operating under multiple trade names, websites, or complex corporate structures. The advisory comes as the agency gears up for the January 31 annual registration deadline and the launch of the Delete Request and Opt-Out Platform, known as DROP, on January 1, 2026.

Data brokers operate in a billion-dollar market built on collecting and selling personal information. Under the Delete Act, any business that acted as a data broker in the prior year must register annually with CalPrivacy, disclose specific operational details, and pay a registration fee. Those fees fund both the state’s public Data Broker Registry and DROP, which will allow Californians to direct all registered data brokers to delete their personal information through a single request.

The new advisory signals concern that some companies may be making themselves harder to find. CalPrivacy says it has observed brokers using trade names or websites that do not appear in their official registrations, complicating consumers’ ability to identify who is handling their data. The agency is also emphasizing that each data broker must register independently, rather than pointing consumers or regulators to a parent company’s or affiliate’s registration.

Failure to comply carries a tangible cost. Data brokers that do not register can face administrative fines of $200 per day, on top of registration fees and any expenses CalPrivacy incurs while pursuing enforcement actions.

“The rules of the road are clear, and we expect data brokers will register as required,” said Michael Macko, CalPrivacy’s head of enforcement. “We will continue using all available tools to investigate potential violations and bring enforcement actions where appropriate.”

CalPrivacy Executive Director Tom Kemp framed the advisory as both a warning and a reminder as the next deadline approaches.

“We want to make it as easy as possible for Californians to exercise their privacy rights,” Kemp said. “With the next registration deadline around the corner, this advisory serves as a reminder for data brokers to register before they hear from us.”

The agency regularly issues enforcement advisories to clarify how it interprets and enforces the California Consumer Privacy Act and the Delete Act. While the advisories do not introduce new rules, they offer a window into enforcement priorities and signal where regulators are likely to scrutinize practices more closely.

With DROP set to go live in just weeks, it is clear that transparency in registration is not optional, and attempts to hide behind branding choices or corporate structures may invite regulatory attention rather than avoid it.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.