California’s Privacy Agency Fines Data Broker $150K for Opt-Out Failures
The California Privacy Protection Agency fined a data broker $150,000 for poor consumer opt-out compliance.
Why it matters: Privacy legal teams must ensure data brokers fully comply with California's evolving consumer privacy laws to avoid costly enforcement actions. This fine underscores growing regulatory risks around opt-out and deletion rights enforcement.
- The California Privacy Protection Agency (CPPA) fined a data broker $150,000 for insufficient consumer opt-outs in May 2024.
- California’s Senate Bill 362 (Delete Act), effective January 1, 2026, requires data brokers to register with CPPA and process consumer deletion requests by regularly updating opt-out lists every 45 days.
- An academic study found only 9% of 522 registered California data brokers fully comply with transparency and deletion requirements post-Delete Act.
- The study reported 43% of data brokers block consumers from exercising full privacy rights, and 64% create obstacles in the opt-out process.
- Legal teams need to reassess compliance practices urgently to mitigate regulatory and reputational risks.
The California Privacy Protection Agency (CPPA) issued a $150,000 fine to a data broker in May 2024 for failing to adequately facilitate consumer opt-out requests, a critical right under California’s consumer privacy framework.
This enforcement highlights the CPPA’s strengthened oversight as California moves toward full implementation of Senate Bill 362, commonly known as the Delete Act, which becomes effective on January 1, 2026. The Delete Act mandates that data brokers must register with the CPPA and efficiently process consumer deletion requests by updating their opt-out mechanisms at least every 45 days to maintain current opt-out records (SB 362 text).
Despite these legal requirements, compliance remains low. An academic study examined 522 registered California data brokers and found that only 9% fully meet the Delete Act’s transparency and deletion provisions. Furthermore, 43% of these brokers actively prevent consumers from exercising their complete privacy rights, while 64% introduce barriers—such as complicated workflows or incomplete information—that hinder consumers’ ability to opt out.
For legal professionals managing privacy compliance, these findings emphasize the urgency of robust legal and operational strategies. Data brokers and their counsel must work to streamline consumer opt-out and data deletion processes in anticipation of intensified CPPA enforcement. Failure to do so exposes firms to escalating financial penalties and reputational damage.
By the numbers:
- $150,000 — fine amount levied by California Privacy Protection Agency against a data broker in May 2024
- 9% — proportion of 522 California data brokers fully compliant with Delete Act's transparency and deletion requirements as per academic research
- 43% — data brokers found to block consumers from exercising full privacy rights under California law
What's next: Enforcement under the Delete Act will intensify as its January 1, 2026 effective date approaches, requiring ongoing compliance monitoring.