CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week

August 13, 2026

SACRAMENTO, CA — Following this week’s decision in LocateSmarter, the California Privacy Protection Agency Board has announced a decision requiring an additional data broker, Cybba, Inc., to pay a $52,400 fine after failing to register with the Agency’s Data Broker Registry by the 2025 deadline.

Cybba is a Boston-based data broker that sells personal information—including geolocation data, internet activity data, and inferences—to facilitate targeted advertising. One of Cybba’s services provides signals from consumers’ purchasing behaviors to identify potential repeat customers and others who are more likely to make purchases. In addition to paying a fine, the decision requires Cybba to post metrics about privacy rights on its website, access the Agency’s Delete Request and Opt-Out Platform (DROP), and process future deletion requests through that system.

“CalPrivacy has been bringing a steady drumbeat of enforcement actions under both the Delete Act and the CCPA, and I don’t see the enforcement activity slowing down anytime soon,” said Michael Macko, the Agency’s head of enforcement. “Especially with the launch of DROP, businesses should take a close look at their activities.”

“DROP is a game changer for Californians seeking to protect themselves from the data broker ecosystem,” said Tom Kemp, CalPrivacy’s executive director. “We remain committed to consistent, meaningful enforcement to make sure data brokers comply with the law.”

The Delete Act requires data brokers to register with CalPrivacy annually in January and pay a fee that funds the Data Broker Registry and DROP. DROP is a first-of-its-kind deletion mechanism that allows consumers to direct all data brokers to delete their personal information in a single request.

For the Enforcement Division, the case was handled by Attorneys Neelofer Shaikh and Gary Lee as part of the Data Broker Enforcement Strike Force.

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California’s cutting-edge privacy laws. Recent actions include:

• Partnering with California Attorney General Rob Bonta and state District Attorneys to hold General Motors accountable for data sharing practices from connected vehicles, resulting in a $12.75 million civil penalty and injunctive terms.
• Issuing a decision requiring PlayOn Sports, the provider of digital ticketing platforms for high school sporting events, to pay a $1.10 million fine and change its practices to remedy privacy violations.
• Requiring Ford Motor Company to pay a $375,703 fine and change its practices to remove unnecessary friction in the opt-out process for Californians.
• Securing a settlement requiring Datamasters, a data broker, to pay a fine and stop selling lists of Californians who have Alzheimer’s disease and other health conditions.
• Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35 million fine and change its business practices for California Consumer Privacy Act (CCPA) violations.
• Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Bringing more than a dozen enforcement actions against additional unregistered data brokers.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.