California Privacy Protection Agency Settles with Data Brokers Over Violations of the Delete Act

California Privacy Protection Agency Settles with Data Brokers Over Violations of the Delete Act

On November 14, 2024, the California Privacy Protection Agency (“CPPA”) made headlines with its announcement of settlements with two data brokers, Growbots, Inc. and UpLead LLC, over their failure to comply with the California Delete Act. This legislation, which came into effect in 2023, requires data brokers to register with the CPPA and pay an annual fee to support the creation of the California Data Broker Registry. The two companies in question were found to have neglected this requirement, resulting in fines and penalties.

As part of the settlements, Growbots will pay a fine of $35,400, and UpLead will pay $34,400. In addition to these fines, both companies have agreed to cover the legal costs incurred by the CPPA in handling these violations, which occurred between February and July 2024. These settlements underscore the CPPA’s commitment to holding companies accountable for failing to meet the regulatory requirements set forth by the Delete Act.

The Delete Act, a pivotal piece of legislation aimed at enhancing consumer privacy rights, was introduced to regulate the activities of data brokers in California. A central provision of the law mandates that data brokers register annually with the CPPA and pay fees that will contribute to the funding of the California Data Broker Registry. This registry will be vital in helping consumers access information about the companies collecting and selling their personal data.

One of the most significant aspects of the Delete Act is the creation of the Data Broker Requests and Opt-Out Platform (“DROP”), a tool designed to enable consumers to request the deletion of their personal data from all registered data brokers with a single, streamlined action. Although DROP will not be available until 2026, it is expected to become a key feature of the CPPA’s efforts to give consumers more control over their personal information.

These recent settlements, along with new regulations adopted by the CPPA, further emphasize the agency’s focus on ensuring that data brokers comply with the law. The new regulations clarify the registration requirements for data brokers and require them to provide additional transparency regarding their data collection practices, including any data they collect that may be exempt from deletion requests.

For businesses in the data collection and privacy space, this is a strong reminder of the importance of staying up to date with evolving privacy laws. As the CPPA continues to ramp up its enforcement efforts, companies must prioritize compliance with registration and reporting requirements to avoid costly fines and legal consequences.

(Image Credit: iStock Photo)

This article is for information purposes only. It is not intended to be and should not be relied on as legal advice for any particular matter.