CalPrivacy targets inaccurate data-broker registrations

What happened

CalPrivacy's Enforcement Division issued Advisory 2026-01 on September 3, 2026, emphasizing that data brokers must provide true and correct annual registration information. The advisory says the Delete Act does not distinguish accidental reporting errors from intentional misrepresentations and warns of a $200 fine for each day incorrect information appears in the registry. It connects accuracy to consumers' ability to understand who collected their information, where it went and how to exercise privacy rights, including through the DROP deletion platform. The document reports enforcement observations and explains existing statutory and regulatory requirements; it does not announce a newly enacted registration scheme.

The advisory's examples go beyond a broker's name and contact details. They ask brokers to reconcile categories such as precise geolocation, reproductive health, citizenship, biometrics and SOGI information, and recipient categories such as government bodies, foreign actors and generative-AI developers. Other examples address changes in customer types and consistency of rights-request metrics. These questions support a comparison between the filed registration and actual collection, sales, sharing and request records for the prior year. The advisory expressly provides no safe harbor, does not establish substantive rights or policy, and leaves case-by-case enforcement decisions to the division; the statutes and regulations control if interpretations conflict.

Why it matters

Registration accuracy depends on operational data inventories and recipient records, so an otherwise timely filing can still create exposure when disclosures do not match actual practices.

Sources

• Enforcement Advisory 2026-01: registration accuracyOfficial · California Privacy Protection Agency · 2026-09-03 · Source review 2026-09-06