On December 3, 2025 the California Privacy Protection Agency (“CPPA”) issued an enforcement decision against ROR Partners LLC (“ROR”) carrying important implications for companies engaged in data-driven advertising. In its order, the CPPA Board required ROR, a Nevada-based marketing firm serving fitness and wellness brands, to pay $56,600 in fines and fees after determining the company operated as a data broker without registering as required under California’s Delete Act.

Findings

According to the CPPA’s findings, ROR Partners amassed “billions of data points” to “create detailed consumer profiles and custom audience lists” used for targeted advertising. These datasets encompassed demographic, socioeconomic, and behavioral information tied to millions of consumers.

ROR Partners also generated inferences about consumers, such as identifying individuals who frequently attend health clubs and placing them in fitness-related audience segments that could be sold for marketing purposes. The CPPA concluded that these activities occurred in 2024 without the required registration in California’s Data Broker Registry.

One of the decision’s central messages is that businesses cannot avoid California’s data broker requirements by bundling sales of personal information with other advertising marketing services.

As the Board emphasized, “a sale is a sale” and “a business cannot bypass the CCPA’s and the Delete Act’s requirements by selling personal information as part of a larger suite of products and services it offers.”

Michael Macko, the CPPA head of enforcement, framed the case as part of a broader shift toward scrutinizing companies that generate and monetize consumer profiles, stating that the CPPA “will scrutinize any business that walks and talks like a data broker to make sure it’s registered, and…will continue to examine businesses that create inferences about consumers to profile them.”

This marks a clear public statement that the CPPA views inference-based advertising (a cornerstone of many modern ad-tech models) as an area ripe for enforcement.

Key Takeaways 

• Marketers and advertisers are firmly within scope: Selling or licensing audience segments, profiles, or behavioral predictions can trigger data broker obligations.

• Inference data is personal information. The CPPA has stated that consumer profiles are protected personal information.

• Annual registration is mandatory: Companies that may have engaged in data broker activity must evaluate their practices and register if applicable.

• The Delete Request and Opt-Out Platform will transform consumer deletion rights: Businesses should prepare for operational and technical demands associated with mass deletion requests beginning in 2026.