CalPrivacy targets inaccurate data-broker registrations
Sep 20, 2026 edition · GC-2026-0048 · Published 2026-09-20 · Version 2 · Announced
CalPrivacy warns that data-broker registration inaccuracies can trigger daily fines even when unintentional.
What happened
CalPrivacy’s September 3 Enforcement Advisory 2026-01 warns data brokers to submit true and correct annual registration information, including the kinds of data collected and specified recipients during the preceding year. It states that incorrect information can trigger a 200 dollar fine for each day a broker fails to register as required. The advisory says the Delete Act does not distinguish an unintentional reporting error from an intentional misrepresentation when either produces incorrect registration information.
Its scenarios ask brokers to reconcile data categories, changing customer types, GenAI developer recipients and rights-request metrics with their disclosures. The advisory also describes annual registration and DROP-account requirements under existing law. It does not declare every health technology business a data broker, and its hypotheticals require analysis of the statutory definitions and actual activity. The document expressly creates no substantive policy, new rights, alternative relief or safe harbor; statutes and regulations control if an interpretation conflicts.
Scope and timing
- Authority status
- Announced
- Applicability
- Potentially applicable
- Audience
- Health-tech
- Jurisdiction
- California
Why it matters
Organizations within the data-broker rules need evidence connecting registration answers to actual collection, sale or sharing and rights-request records.
Recommended action
Have Privacy and Legal determine data-broker applicability, reconcile filed answers with inventories, recipients and metrics, and correct inaccuracies through the applicable registration process.
Sources
- Enforcement Advisory 2026-01: registration accuracyOfficial · California Privacy Protection Agency · 2026-09-03 · Source review 2026-09-06
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →