CalPrivacy targets inaccurate data-broker registrations

What happened

CalPrivacy’s September 3 Enforcement Advisory 2026-01 says data brokers must provide true and correct annual registration information. It warns that inaccurate responses can trigger a 200 dollar daily fine for failing to register as required, and that the law does not distinguish inadvertent mistakes from intentional misrepresentations when both produce incorrect information. The advisory concerns compliance with existing registration requirements, not a new general registration duty for every health technology company.

The examples ask brokers to check collected data types, changes in recipients, GenAI developer relationships and rights-request metrics against their filings and privacy disclosures. The advisory also describes DROP-account requirements and the registry’s role in helping consumers exercise deletion rights. It expressly supplies no safe harbor, new substantive policy or alternative relief; statutes and regulations control any conflict. Applicability still depends on the actual business activity and statutory definitions rather than the sensitivity of health-related data alone.

Why it matters

Businesses within the data-broker rules need registration answers supported by actual inventories, recipient records and rights-request metrics.

Sources

• Enforcement Advisory 2026-01: registration accuracyOfficial · California Privacy Protection Agency · 2026-09-03 · Source review 2026-09-06