Enforcement Advisory Targets Incorrect Information in Data Broker Registration

September 3, 2026

SACRAMENTO, CA — CalPrivacy has issued Enforcement Advisory 2026-01 highlighting data brokers who provide incorrect information in their annual registration with California’s data broker registry. The advisory stresses that data brokers are liable to pay a fine for each day incorrect information appears in the registry, observing that the Enforcement Division has brought multiple enforcement actions over reporting errors.

California’s Delete Act requires businesses that operated as data brokers in the prior year to register with the Agency each year and disclose certain information. Those disclosures are important: the registry gives Californians visibility into the data collection and distribution practices of data brokers, including information about metrics, types of data collected, and recipients of certain data.

The advisory cautions that the failure to provide correct information comes with consequences. Data brokers are liable for a $200 fine for each day they fail to register “as required by” the Delete Act’s reporting provisions.

“The Enforcement Division will continue using all the tools at its disposal to protect Californians’ privacy, including publishing advisories to help stop violations from happening in the first place,” said Michael Macko, CalPrivacy’s head of enforcement.

“The launch of CalPrivacy’s Delete Request and Opt-Out Platform (DROP) this year supercharged privacy for Californians,” said Tom Kemp, CalPrivacy’s executive director. “DROP works because the law requires data brokers to report correct information about their activities. Californians are entitled to nothing less.”

CalPrivacy issues periodic enforcement advisories on aspects of the California Consumer Privacy Act and the Delete Act. These advisories provide observations from the Enforcement Division to help educate the public and businesses about their rights and responsibilities.

If consumers think a business provided incorrect information with its data broker registration, they should report it via the agency’s complaint form. Californians can also learn more about their rights and how to exercise those rights at Privacy.ca.gov.

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California’s cutting-edge privacy laws. Recent actions include:

• Bringing more than a dozen enforcement actions against additional unregistered data brokers, including an action against SalesIntel Research earlier this week.
• Partnering with California Attorney General Rob Bonta and state District Attorneys to hold General Motors accountable for data sharing practices from connected vehicles, resulting in a $12.75 million civil penalty and injunctive terms.
• Issuing a decision requiring PlayOn Sports, the provider of digital ticketing platforms for high school sporting events, to pay a $1.10 million fine and change its practices to remedy privacy violations.
• Requiring Ford Motor Company to pay a $375,703 fine and change its practices to remove unnecessary friction in the opt-out process for Californians.
• Securing a settlement requiring Datamasters, a data broker, to pay a fine and stop selling lists of Californians who have Alzheimer’s disease and other health conditions.
• Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35 million fine and change its business practices for California Consumer Privacy Act (CCPA) violations.
• Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Bringing more than a dozen enforcement actions against additional unregistered data brokers.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.