California’s DROP Enforcement Phase Is Live

California’s new data deletion regime is now in its enforcement phase, and the penalty structure is severe enough that any company with a data licensing, resale, enrichment, appending, advertising, or audience-building business should confirm where it stands.

As of Aug. 1, every company registered as a data broker under California law must access the state’s Delete Request and Opt-out Platform, or DROP, at least once every 45 days, process consumer deletion requests, and report request status through the platform. If a consumer’s information matches the broker’s records, the broker must delete associated personal information, including inferences, unless a legal exemption applies. A broker that fails to process deletion requests may face $200 per unprocessed request, per day, plus CalPrivacy’s potential investigative and administrative costs.

The scale involved is straightforward to check against the statutory formula. A broker holding matchable records on 5,000 consumers and leaving those matching requests undeleted for a full 45-day period could face $45 million in potential statutory exposure. At 20,000 consumers, the same formula produces $180 million in potential exposure. Those are not aggressive assumptions; they apply the per-request, per-day penalty to a modest fraction of a DROP queue that already exceeded 300,000 consumer requests before the Aug. 1 processing deadline. 

What Brokers Have to Do Now 

CalPrivacy’s DROP technical specifications require brokers to standardize their own records before hashing them so those records can be compared against DROP’s hashed consumer identifiers. The standardization rules include removing punctuation and other non-letter or non-digit characters, converting dates to YYYYMMDD format, lowercasing certain values, and using the last 10 digits for phone numbers. That standardization reduces the operational room for false no-match results based on formatting differences such as punctuation, capitalization, hyphenation, or date formatting.

Once a match is found, the broker must delete the relevant personal information, including inferences, unless an exemption applies. The broker must also direct service providers and contractors to take the required action for personal information associated with DROP requests. The broker must report the status of each deletion request in DROP and maintain deletion-request records to ensure the consumer’s information remains deleted into the future. 

That operational point matters for leadership. DROP compliance is not just a legal interpretation or a registry filing. It requires repeatable technical workflows, vendor instructions, evidence of completion, and a durable suppression process that can survive personnel changes, system migrations, and new data acquisitions. 

Who Actually Counts as a Data Broker 

Many companies that meet California’s data broker definition may not realize it. The Delete Act defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. It is easy to read that definition and assume that a company is safe because it collects data directly from its own customers. 

CalPrivacy’s regulations say otherwise. The regulations clarify that a business does not have a direct relationship with a consumer simply because it collects personal information directly from that consumer; the consumer must intentionally interact with the business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business’s products or services. They also clarify that a business can still be a data broker as to personal information it sells about a consumer that it collected outside a first-party interaction with that consumer. 

Put differently, the test runs data flow by data flow, not company by company. A business can have a legitimate direct relationship with its own customers and still act as a data broker with respect to a separate stream of data it licenses, enriches, appends, or resells about people who never chose to interact with it for that purpose. 

That is the practical lesson from ROR Partners, a Nevada marketing firm CalPrivacy fined $56,600 in December 2025 for failing to register as a data broker. According to CalPrivacy, ROR used billions of data points to build detailed consumer profiles and custom audience lists for targeted advertising, including audience segments for fitness and wellness brands. It is also the lesson from S&P Global, which CalPrivacy fined $62,600 in January 2026 for failing to register due to an administrative error. These actions were handled by the Data Broker Enforcement Strike Force that CalPrivacy launched in November 2025 specifically to review the data broker industry for both Delete Act registration compliance and CCPA compliance. The lesson is not limited to traditional data brokers: even sophisticated companies can miss the filing if no one has mapped the relevant data flows against California’s definition. 

Rickenbacher Data, doing business as Datamasters, was fined $45,000 in January 2026 for failing to register as a data broker. CalPrivacy found that Datamasters bought and resold names, addresses, phone numbers, and email addresses of millions of people with health conditions including Alzheimer’s disease, drug addiction, and bladder incontinence for targeted advertising. CalPrivacy also stated that Datamasters would stop selling all forms of personal information about Californians. 

And then there is Jerico Pictures, doing business as National Public Data, the company associated with the widely reported 2024 breach involving alleged exposure of roughly 2.9 billion records. Its separate brush with CalPrivacy had nothing to do with that breach. CalPrivacy ordered the company to pay a $46,000 fine for failing to register and pay the annual fee required by the Delete Act. Two privacy failures, two enforcement tracks, one company. 

An On-Time Registration Is Not Enough 

One enforcement pattern stands out even for careful compliance departments: what happened to WINR Data, Clarivate, and Decision Resources in June 2026. Privacy Daily reported that CalPrivacy assessed a $12,200 administrative fine against WINR Data and fines of $10,800 against Clarivate and Decision Resources. The same report states that the cases involved companies that erroneously entered in their January 2026 registrations that they sold or shared data to a foreign actor in 2025. All three companies reportedly registered on time, caught the error themselves, and voluntarily informed CalPrivacy. CalPrivacy fined them anyway. 

That matters because SB 361 expanded data broker disclosure obligations, including disclosures about sharing with foreign actors, government entities, law enforcement, and generative AI developers. The registry is not just a formality. It is a public-facing statement about the company’s data business, data categories, and downstream recipients. For companies whose data-sharing relationships change during the year, the filing should be treated more like a disclosure-control exercise than a routine privacy questionnaire. 

The Opt-Out Friction Pattern and Data Minimization 

On Aug. 11, CalPrivacy announced its enforcement action against LocateSmarter, LLC, a data broker headquartered in Iowa that provides location, contact, and fraud-detection services. The order imposed $116,490 in fines and fees and represents the first enforcement action against a data broker under both the CCPA and the Delete Act. But the order also matters for companies outside the data broker registry because it crystallizes an enforcement pattern that applies to any CCPA-regulated business.  

In 2025, LocateSmarter required consumers to provide their full name, mailing address, and the last four digits of their Social Security number to opt out of the sale or sharing of their personal information. CalPrivacy held that this both unlawfully imposed a verification requirement on a non-verifiable request and violated the CCPA’s data-minimization mandate by requiring more information than necessary to process the request. 

That is significant because CalPrivacy’s regulations distinguish opt-out requests from delete, know, and correct requests. Opt-out requests may not be treated as verifiable consumer requests under CalPrivacy’s regulations, and businesses may not require consumers to create accounts, provide government identification, or submit sensitive information like Social Security numbers to exercise opt-out rights. CalPrivacy found that requiring an SSN “could intimidate consumers from exercising their privacy rights” and noted that only a tiny fraction of California’s nearly 40 million residents had submitted opt-out requests to LocateSmarter. 

The legal theory is not new, but the LocateSmarter order does add clarity to how these laws will be enforced. CalPrivacy’s Enforcement Division issued Enforcement Advisory No. 2024-01 in April 2024, titled “Applying Data Minimization to Consumer Requests,” which states that data-minimization principles apply to the processing of consumers’ CCPA requests. The advisory walks through scenarios involving opt-out and deletion requests and reminds businesses to apply the principle to each purpose for which they collect personal information, including information collected when processing CCPA requests. Todd Snyder and other earlier enforcement actions applied the same principle; LocateSmarter extends it to the data broker context and pairs it with Delete Act exposure. 

A Board-Level Question, Not Just a Compliance One 

CalPrivacy has not confined its willingness to fine large, recognizable companies to the data broker registry. By its own account, the agency’s recent enforcement record includes a $1.35 million fine against Tractor Supply Company and a $345,178 fine against Todd Snyder, both under the broader CCPA rather than the Delete Act specifically. CalPrivacy has also brought enforcement actions against automakers and other well-known brands for imposing excessive verification or friction requirements on consumer opt-out requests. Four CCPA enforcement actions, including LocateSmarter, have now turned on the same issue. CalPrivacy has made clear that opt-out requests are non-verifiable under the CCPA regulations, and requiring more information than necessary to process them violates both the opt-out rules and the CCPA’s data-minimization mandate. Those cases show that CalPrivacy is willing to impose meaningful penalties on mainstream companies for privacy-program failures, not only on companies whose core business is controversial data brokerage. 

That belongs in front of a board, not just the privacy committee. The new foreign-actor and AI-developer disclosure requirements added by SB 361 mean the Delete Act already reaches into AI governance and sensitive-recipient oversight. CalPrivacy’s reported willingness to fine companies after voluntary self-correction is a warning signal for how the agency may treat inaccurate sensitive-recipient or AI-related disclosures going forward. California policymakers are also continuing to revisit the timing and scope of data broker obligations, so companies should not assume that today’s 45-day operating cadence is the final version of the rule. 

The registry itself is public record. Anyone, including advocacy groups and journalists, can review a broker’s disclosures and compare them to what the company appears to do in the market. An inaccurate answer on a foreign-actor, government-recipient, or AI-developer disclosure does not stay quietly inside a filing cabinet. It becomes a public statement California has made searchable. 

What Companies Should Do Now 

The classification question deserves an early look at the data-flow level that CalPrivacy’s regulations describe, not just at the company level. Companies that license or resell data, even as a secondary revenue stream, including ad-tech vendors, list resellers, appending services, and enrichment services, are generally better served assuming they may be in scope until counsel clears them rather than the other way around. 

Where the answer is yes, this is as much an engineering project as a legal one. Someone has to build the hashing, matching, deletion, reporting, and suppression-list infrastructure. Someone also has to make sure deletion instructions reach every service provider and contractor sitting downstream. Legal, privacy, security, engineering, procurement, and vendor-management teams should be looped in at the same time, not sequentially. 

Any company processing opt-out or limit-sensitive-personal-information requests should immediately audit its intake forms for fields requiring Social Security numbers, government identification, or other verification steps. If all request types run through a single verification gate, that is itself a likely violation. The four opt-out-friction enforcement actions to date make clear that request workflows should be configured so opt-out and limit requests are never routed through the verification flow used for delete, know, or correct requests. 

The accuracy of the current registration deserves a second look too, particularly the foreign-actor and AI-developer disclosure answers added by SB 361. The WINR Data, Clarivate, and Decision Resources outcomes are a fair signal that a good-faith mistake, caught and reported voluntarily, may not avoid enforcement risk on its own. 

Clear ownership of the recurring 45-day cycle and a paper trail built as the company goes matter more here than in many compliance programs. Companies should be able to show when a list was pulled, how matching ran, what was deleted, how downstream instructions were sent, and how status was reported. That record is also the foundation for the independent third-party audit obligations that begin Jan. 1, 2028. 

Finally, a short board briefing on this is a better use of time than a line item buried in a compliance report. A per-request, per-day penalty structure is a meaningfully different risk than a fixed statutory cap. CalPrivacy’s first wave of data broker and CCPA enforcement provides a clear enough picture of how the agency may use that structure once it has the chance. 

Conclusion 

The practical point is not that every company with customer data is a data broker. The point is that the classification analysis now needs to be done carefully, at the data-flow level, before the penalty clock becomes the forcing event. If a company licenses, resells, appends, enriches, or otherwise monetizes consumer data that it obtained outside a direct first-party relationship, the safest next step is a focused assessment of whether the Delete Act applies, whether the company’s registry answers are accurate, and whether its technical systems can actually run the DROP cycle every 45 days.