CalPrivacy targets inaccurate data-broker registrations
Sep 27, 2026 edition · GC-2026-0048 · Published 2026-09-27 · Version 2 · Announced
CalPrivacy’s data-broker advisory emphasizes accurate registration disclosures and a 200-dollar daily exposure, including unintentional errors.
What happened
CalPrivacy’s September 3 Enforcement Advisory 2026-01 warns that data brokers must give true and correct annual registration information, including data types, recipients and required rights-request metrics. The advisory says the Delete Act does not distinguish an accidental error from an intentional misstatement when the resulting entry is incorrect, and describes a 200-dollar fine for each day of failure to register as required. Examples include reproductive-health, citizenship, precise-location and other sensitive data and sharing with specified government, foreign-actor or GenAI-developer categories.
The advisory’s scenarios ask businesses to reconcile disclosures when their collected fields or customers change and to compare registry and privacy-policy rights-request metrics. It also recites the annual January 31 registration and January 2026DROP-account requirements. Those statements concern businesses actually qualifying as data brokers, not every health-tech company or healthcare record holder. The document expressly says it creates no substantive policy, alternative relief or safe harbor; statutes and regulations control and enforcement is assessed case by case. Organizations need their actual data and recipient inventory to determine whether a registration statement is accurate.
Scope and timing
- Authority status
- Announced
- Applicability
- Potentially applicable
- Audience
- Health-tech
- Jurisdiction
- California
Why it matters
A registration form can become inaccurate through data or recipient changes even when a business did not intend to mislead.
Recommended action
Confirm data-broker applicability with Legal, reconcile registrations and required metrics against current and prior-year data/recipient records, and correct discrepancies through the applicable process without assuming the advisory supplies a safe harbor.
Sources
- Enforcement Advisory 2026-01: registration accuracyOfficial · California Privacy Protection Agency · 2026-09-03 · Source review 2026-09-06
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →