On September 3, 2026, the California Privacy Protection Agency (“CalPrivacy”) released an enforcement advisory that warns data brokers that they must provide only true and correct information when completing their annual registrations with California’s Data Broker Registry. The advisory emphasizes that failing to provide accurate registration information violates the law and triggers a $200 fine for each day incorrect information remains in the registry. CalPrivacy’s Head of Enforcement, Michael Macko, stated that the Enforcement Division “will continue using all the tools at its disposal to protect Californians’ privacy, including publishing advisories to help stop violations from happening in the first place.” The advisory comes as CalPrivacy continues an active enforcement agenda, having recently brought more than a dozen actions against unregistered data brokers and secured significant penalties against several offenders.
The advisory details the legal framework underlying the registration requirement, explaining that under the Delete Act, businesses that operated as data brokers in the prior year must register with the Agency by January 31 each year, pay a registration fee, and disclose certain information about their data practices. As of January 2026, data brokers are also required to establish a DROP (Delete Request and Opt-Out Platform) account for processing deletion requests submitted by consumers. Registered data brokers must disclose the types of personal information they collected, which can include sensitive categories such as reproductive health data, citizenship and immigration status, sexual orientation, gender identity, biometric data, precise geolocation, and Social Security numbers. They must also disclose whether they shared this data with entities such as the federal or state government, foreign actors, law enforcement, or developers of GenAI systems.
The advisory also provides a series of hypothetical scenarios illustrating how data brokers should review their registration practices for accuracy. CalPrivacy stresses that the Delete Act does not distinguish between unintentional mistakes and intentional misrepresentation — which both result in incorrect information and carry consequences — and urges businesses to carefully review their obligations before completing their registrations.
CalPrivacy News Release | Enforcement Advisory No. 2026-01