On 3 September 2026, the California Privacy Protection Agency (CalPrivacy) issued Enforcement Advisory 2026‑01, which states that data brokers that provide incorrect information in their annual registration under the Delete Act are liable for a fine of US$200 for each day the information remains incorrect in the registry. The Delete Act requires businesses that acted as data brokers in the previous year to register annually and disclose specified information, including metrics, types of data collected, and recipients of certain data.

Michael Macko, head of enforcement at CalPrivacy, said the Enforcement Division 'will continue using all the tools at its disposal to protect Californians' privacy, including publishing advisories to help stop violations from happening in the first place'. Tom Kemp, executive director of CalPrivacy, added that the launch of CalPrivacy's Delete Request and Opt‑Out Platform (DROP) 'supercharged privacy for Californians' because the law obliges data brokers to report correct information about their activities.

The advisory advises consumers who suspect a broker has provided incorrect information to submit a complaint via CalPrivacy's online form and directs them to the agency's website for information on their rights. The advisory is part of CalPrivacy's regular series of enforcement advisories on the California Consumer Privacy Act and the Delete Act, intended to educate the public and businesses about compliance obligations and privacy protections.

Why does this matter?

Data broker regulation is moving beyond registration requirements toward active enforcement of transparency and accountability obligations. By attaching daily penalties to inaccurate disclosures, California is strengthening incentives for brokers to provide reliable information about what data they collect, how it is used, and who receives it, while also giving consumers a clearer basis for exercising deletion and opt-out rights.