CalPrivacy Issues Enforcement Advisory Highlighting Data Broker Registration

What happened

CalPrivacy issued Enforcement Advisory No. 2025‑01 reminding data brokers to comply with the California Delete Act registration requirements. Brokers must list every trade name and website, register independently, and pay an annual fee. Failure to register incurs administrative fines of $200 per day. The advisory notes that the consumer‑facing Delete Request and Opt‑Out Platform (DROP) becomes available on 1 January 2026. The next registration deadline is 31 January 2027.

Why it matters

Data brokers that rely on parent‑company registrations or omit trade names risk daily fines; they should audit their disclosures and file separate registrations before the 31 January deadline.

Business impact

Non‑compliance will increase legal costs and operational overhead as firms must adjust registration processes and maintain up‑to‑date public identifiers.

Checklist

• Disclose all trade names and website URLsHigh priority

  List every name and domain used to provide data‑broker services in the annual registration.

• Register independentlyHigh priority

  Submit a separate registration for each broker entity rather than referencing a parent or affiliate.

• Meet the 31 January 2027 registration deadlineCritical priority

  Complete registration and pay fees before the deadline to avoid $200 per day fines.

• Monitor DROP availabilityMedium priority

  Prepare to respond to consumer deletion requests through the Delete Request and Opt‑Out Platform after 1 January 2026.

Who reported it

Discussion