The California Privacy Protection Agency (CPPA) Board approved new data broker regulations on 8 November 2024 during an open meeting. These regulations enhance the Delete Act, which requires data brokers to register with the state and comply with transparency and deletion requirements for consumer data.
The new rules clarify which businesses qualify as data brokers and impose stricter obligations. A business is considered a broker if it collects or sells consumer data without a direct relationship with the individual.
However, even companies with direct consumer interactions can be labeled as brokers if they sell data obtained indirectly.
The CPPA also raised the data broker registration fee to $6,600 to help fund the Delete Act’s implementation, which costs an estimated $3.5 million. Enforcement has already begun, with settlements reached for noncompliance by Growbots and UpLead, totaling over $69,000 in penalties.
Looking ahead, the CPPA is advancing the Delete Request and Opt-out Platform (DROP), a free system for California consumers to delete or opt out of data sharing through a single secure platform. Starting January 2026, brokers must implement DROP and comply with opt-out and deletion requests.
See the Delete Act here.
See the new data broker regulations here.
The California Privacy Protection Agency (CPPA) Board approved new data broker regulations on 8 November 2024 during an open meeting. These regulations enhance the Delete Act, which requires data brokers to register with the state and comply with transparency and deletion requirements for consumer data. The new rules clarify which businesses qualify as data brokers […]