California's data-broker enforcement round: two new decisions

California Privacy Protection Agency (CalPrivacy)2026-01-08Editorial review: reviewed

CalPrivacy's board issued two decisions in January 2026 against data brokers for failing to register under the Delete Act — one a Texas-based reseller of health-condition marketing lists, the other a large data and technology provider that the agency describes as an administrative error.

Data brokersEnforcementPersonal-data deletionSensitive personal information

Enforcement is where a privacy statute stops being abstract. California’s regulator published two decisions from its Data Broker Enforcement Strike Force in January 2026.

Rickenbacher Data LLC (d/b/a Datamasters). The agency says this Texas-based reseller of personal information was ordered to pay a $45,000 penalty for failing to register as a data broker under California’s Delete Act, and to stop selling all Californians’ personal information. The agency describes the business as having bought and resold names, addresses, phone numbers and email addresses of millions of people — including lists of people with Alzheimer’s disease, drug addiction and bladder incontinence, and lists built on age, perceived race, political views, grocery purchases and banking activity.

S&P Global, Inc. The agency says it was ordered to pay a $62,600 penalty for failing to register, which the agency characterises as an administrative error, and to adopt registration and compliance-auditing procedures.

Context the agency supplies. The announcement also lists earlier actions against Tractor Supply ($1.35m), Todd Snyder ($345,178) and American Honda ($632,500), a shutdown agreement with a broker called Background Alert, and “more than ten” actions against other unregistered brokers.

What this does and does not tell you. These are agency decisions, which are the operative enforcement acts — stronger evidence of a violation than a press release alone, though the decisions themselves should be read for their findings. The recurring theme is failure to register, not adjudicated harm to any specific consumer. Registration is a precondition to a lawful data-broker in California; failing it is enforceable on its own.

The practical takeaway for readers: a broker that never registered is still on someone’s list. That is precisely the gap the free DROP mechanism is designed to close for eligible residents.

← All news & research