On December 23, 2024, the California Privacy Protection Agency announced two settlements with data brokers for failing to register and pay the annual fee required by California Senate Bill 362 (the Delete Act). PayDae, Inc. (doing business as Infillion) and The Data Group, LLC settled for $54,200 and $46,600 respectively, comprising the $200 daily fine for failing to register by the January 31 deadline. The CPPA has again opted to announce the settlements without publicly disclosing a complaint or settlement order.

These settlements represent the “third wave of enforcement activity” in as many months. On October 30, it announced an investigatory sweep into unregistered data brokers. Two weeks later, the agency disclosed its first two public enforcement actions: settlements with Growbots and UpLead for failing to register. Already known for its Friday afternoon announcements, the CPPA is developing a penchant for releasing enforcement updates shortly before holidays.

Takeaways for Businesses

Expect continued focus on data broker practices in California and beyond, with registration central to these enforcement efforts. Businesses should assess if they are considered a data broker under recently-approved CPPA regulations. The regulations narrow the “direct relationship” exception in the statutory “data broker” definition, stating a business “is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business did not collect directly from the consumer.” These regulations significantly expand the scope of California’s data broker law beyond that of similar laws in Texas, Oregon, and Vermont.

Watch out for the fee increase. At its November meeting, the CPPA board approved raising the annual registration fee from $400 to $6,600 to cover the development and maintenance of its “Deletion Request and Opt-out Platform.”

Ensure registration with all applicable registries. The CPPA and enforcers of data broker laws have increasingly been checking their work against other state registries to identify unregistered data brokers. As of December 23, 2024, neither PayDae nor The Data Group is registered in Texas, which has been sending notices to data brokers not registered with its registry.