Articles

November 24, 2025

Hudson Cook Enforcement Alert: California Launches Data Broker Enforcement Strike Force

Megan Nicholls and Kristen Yarows

California Launches Data Broker Enforcement Strike Force

Megan Nicholls and Kristen Yarows

HIGHLIGHTS:

  • The Strike Force will operate within the California Privacy Protection Agency's Enforcement Division to investigate privacy violations and review compliance with the Delete Act and the California Consumer Privacy Act
  • The Strike Force will build on California's public investigative sweep of data brokers that it announced in October 2024.

SUMMARY:

On November 19, 2025, the California Privacy Protection Agency ("CalPrivacy") announced that it is establishing a Data Broker Enforcement Strike Force ("Strike Force") within its Enforcement Division. The Strike Force will investigate privacy violations and review for compliance with the data broker registration requirement in the Delete Act and compliance with the California Consumer Privacy Act ("CCPA"). The Delete Act requires data brokers to register annually with CalPrivacy and pay a registration fee. The Delete Act imposes significant data deletion and disclosure obligations on data brokers. Data brokers who fail to register under the Delete Act face fines of $200 per day.

CalPrivacy is hoping to build on its public investigative sweep of data broker registration compliance under the Delete Act that it initiated in late 2024. CalPrivacy reported that the investigative sweep has led to eight enforcement actions - a record-setting number - including an enforcement action and $1.35 million fine against a large rural lifestyle retailer over CCPA violations. The Strike Force will provide additional resources to empower CalPrivacy to pursue additional investigations and combat potential violations.

CalPrivacy's head of enforcement said, "[f]or decades, strike forces have been a mainstay at U.S. Attorney offices and state Attorney General offices across the United States. [CalPrivacy] intend[s] to bring the same level of intensity to our investigations into the data broker industry."

On January 1, 2026, CalPrivacy will launch its Delete Request and Opt-Out ("DROP") Platform. The DROP Platform is designed to send a consumer's single request to over five hundred data brokers registered under the Delete Act. CalPrivacy promises to "hold data brokers accountable to their obligations under the CCPA and Delete Act."

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.