As our readers know, the California Privacy Protection Agency (“Agency”) was established by the California Consumer Privacy Act (“CCPA”). California’s Delete Act, effective as of January 1, 2023, established, among other things, certain consumer data broker registration requirements. The Agency is responsible for enforcing the Delete Act and, as discussed below, is now actively pursuing companies which fail to comply with the Delete Act’s data broker registration requirements.
Data Broker Registration Oversight
In its own words, “[t]he Agency is responsible for implementing and enforcing the CCPA as well as the Delete Act, which creates additional requirements unique to data brokers.” The Delete Act broadly defines “data broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” The CCPA defines selling as the “renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating . . .” consumer information for monetary or other valuable consideration. Although certain companies (e.g., credit reporting agencies) are specifically excluded from the definition of data broker under the Delete Act, these exceptions largely do not apply to most data brokers. On October 30, 2024, the Agency’s Enforcement Division announced that it would undertake an investigative data broker registration compliance sweep. That investigation resulted in the Agency entering into settlement agreements with two companies, Growbots, Inc. and UpLead LLC, for their purported failure to comply with the data broker registration and annual fee requirements of the Delete Act.
Failing to register as a data broker may result in significant costs. The Delete Act imposes a fine of $200 for each day that data brokers fail to register. In addition, the Delete Act allows for the recovery of the Agency’s attorneys’ fees and expenses. Other states have similar data broker registration laws in place. For instance, Texas’ data broker law mandates that data brokers register with the Texas Secretary of State, pay a $300 fee, and provide information about their consumer data practices. The law requires the Secretary of State to maintain a searchable, central registry of data brokers on its website. Data brokers violating the Texas registration requirements may be liable for civil penalties of $100 per day; but fines are capped at $10,000 per 12-month period. Notably, the law provides that violations of the personal data protection requirements constitute actionable deceptive trade practices, which allows the Texas State Attorney General to seek penalties of up to $10,000 per violation. Similarly, Vermont’s data broker law requires data brokers to register with the Vermont Attorney General and pay a $100 annual registration fee. Like Texas’ data broker law, a violation of Vermont’s data broker law is considered an unfair and deceptive act in violation of Vermont’s consumer protection law.
Data Broker Registration Reminder!
Readers of this blog know that state and federal agencies have made consumer data privacy a top priority. As such, if your company qualifies as a data broker, it is imperative that you follow the registration requirements in states which require data broker registration. As more states look to require data broker registration, businesses must seek the advice of qualified legal counsel to help navigate existing and emerging issues presented by applicable state regulations.
[View source.]
