Data Broker Settles with Calif. Privacy Agency Amid Registration Sweep

The CPPA board approved the settlement unanimously during a closed session Monday, though the settlement wasn’t immediately available publicly. The state privacy agency revealed news of the settlement Wednesday. It's the latest action stemming from the CPPA’s investigative sweep of Delete Act compliance that it announced Oct. 30.

"This was a complete oversight by us," KMA President Linda Bridson told us. She said her company’s failure was due to a misunderstanding about California Consumer Protection Act registration requirements.

Kelley Drye privacy attorney Alyssa Hutnik said businesses should interpret the fifth CPPA enforcement action of this type in roughly three months as an important reminder for companies to quickly assess whether they must register.

In violation of the California Delete Act, KMA failed to register between Feb. 1 and Nov. 5 last year, the CPPA said. Also, KMA didn't pay an annual fee that funds the state’s data broker registry and an in-development delete request and opt-out platform coming in 2026, said the agency. In addition to the fine, KMA agreed to pay the CPPA Enforcement Division’s attorney fees and other costs resulting from noncompliance.

KMA was “totally in compliance” when the CCPA took effect about five years ago, said Bridson, adding that KMA believes “privacy is paramount.” At the time, the company immediately registered with the California attorney general's office, then in charge of the data broker registry. “We were under the impression that once we registered, we were registered,” said Bridson. “Unfortunately for us, that was incorrect.”

As soon as KMA learned of the problem, it explained itself to the CPPA, apologized and said it would pay the $200 daily fee, she said. KMA asked for -- but didn't receive -- a discount on the total fee, she said. “It was a very, very hefty bill, but we have to do what we need to do.” In addition to the penalty, KMA paid the 2024 registration fee of $400 and 2025’s much-increased registration fee of $5,600, she said.

Businesses that operated as data brokers in 2024 have until Friday to register with the CPPA, or they will similarly face $200 daily fines for non-compliance. “Our ongoing enforcement shows that we’ll continue to bring transparency and accountability to the data broker industry," CPPA Enforcement Head Michael Macko said. "With the next registration deadline around the corner, we encourage data brokers to register before the daily fines start to accrue.”

Hutnik predicted “many more” CPPA announcements ahead. From the five enforcement actions since October, it appears that “the sweep was laser focused on that single issue” of whether a data broker is registered, “likely so they could quickly get to resolution and a public announcement,” emailed Hutnik. “It’s also useful for raising awareness within the business community about the importance of rigorously evaluating whether your business practices trigger the data broker definition … and if so, move to register before the deadline at the end of the month.”

"The CPPA’s fifth enforcement action against data brokers within the span of a few months underscores the importance of evaluating whether the Delete Act applies to your organization," emailed privacy attorney Kiran Jeevanjee of Wyrick Robbins. "With the 2025 registration deadline ... looming, organizations should take proactive steps to determine their status under the California Delete Act, register with the CPPA when necessary, and implement appropriate processes to comply with the law’s requirements."