CalPrivacy targets inaccurate data-broker registrations
Oct 11, 2026 edition · GC-2026-0048 · Published 2026-10-11 · Version 3 · Announced
CalPrivacy's September 3 advisory emphasizes accurate annual data-broker registrations, including the information collected and recipients of shared or sold data. It describes $200-per-day exposure for inaccurate registration and makes clear that unintentional mistakes are not automatically excused; the advisory itself creates no new safe harbor.
What happened
CalPrivacy Enforcement Advisory 2026-01 describes observed failures to provide true and correct annual data-broker registration information. The advisory explains that businesses operating as data brokers in the prior year must register by January 31, pay the fee, and make the specified disclosures. It highlights categories such as reproductive-health, location, citizenship, and biometric information, and recipient categories including governments, law enforcement, foreign actors, and generative-AI developers. Its point is accuracy about actual prior-year activity, not a finding that every health-related business qualifies as a broker.
The agency describes a $200 administrative fine for each day of failure to register as required and explains that incorrect information can trigger that exposure; the Delete Act does not distinguish an inadvertent mistake from an intentional misrepresentation for the accuracy requirement. The advisory uses hypothetical scenarios to illustrate inventory, recipient, and rights-request-metric questions. It expressly reserves case-by-case enforcement and states that advisories do not establish substantive policy or rights, provide legal advice, or offer alternative relief or a safe harbor. The statutes and regulations control if interpretations conflict.
Scope and timing
- Authority status
- Announced
- Applicability
- Potentially applicable
- Audience
- Health-tech
- Jurisdiction
- California
Why it matters
Health-tech businesses that qualify as data brokers should reconcile registry disclosures with actual data types and recipients, including reproductive-health data and sharing with GenAI developers. The advisory creates no new substantive policy or safe harbor.
Recommended action
Privacy and legal teams should confirm data-broker applicability and compare filed disclosures with data inventories, recipient records, and rights-request metrics. Correct discrepancies through the applicable process.
Sources
- Enforcement Advisory 2026-01: registration accuracyOfficial · California Privacy Protection Agency · 2026-09-03 · Source review 2026-10-11
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →