Skip to Content

California Privacy Protection Agency Announces Delete Act Enforcement Sweep
November 01, 2024

Keeping the season spooky for data brokers, the enforcement division of the California Privacy Protection Agency announced on October 30, 2024, that it is conducting a public investigative sweep of data broker registration compliance under California’s Delete Act.

What Is a Data Broker?

A data broker is defined as “a business that knowingly collects and sells to third parties the personal information of a [California] consumer with whom the business does not have a direct relationship.” “Selling” includes transfers of personal information for any valuable or monetary consideration.

There are several exclusions to the definition of a data broker. For example, the Delete Act does not apply to entities covered by the Gramm-Leach-Bliley Act (GLBA) or the Health Insurance Portability and Accountability Act (HIPAA), among others.

What Do Data Brokers Need to Do?

Signed into law in October 2023, the Delete Act requires data brokers to annually register, pay a fee, and provide the following information to the California Privacy Protection Agency:

  1. Whether the company collects the personal information of minors, reproductive health care data, or precise geolocation data;
  2. The number of consumer rights requests the broker received during the prior calendar year; and
  3. The median and mean number of days by which the data broker substantively responded to those requests.

These statistics and information regarding consumers’ rights under the California Consumer Privacy Act must also be disclosed in a link on the data broker’s website.

Covered businesses that operated as a data broker during the 2024 calendar year have until January 31, 2025, to register or face a penalty of $200 per day.
Authored By
Image: Elliott Siebers
Elliott Siebers
Image: Patricia M. Carreiro
Patricia M. Carreiro
Related Practices
Cybersecurity and Privacy Technology
Related Industries
Technology
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.

Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.