What's Happening?
California is enhancing its enforcement of privacy regulations under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). The state has established a new division within
CalPrivacy, specifically targeting compliance in the data broker industry. This division, known as the Data Broker Enforcement Strike Force, aims to ensure adherence to the CCPA and the upcoming Delete Act, effective January 1, 2026. The Delete Act mandates data brokers to register, pay a fee, and comply with consumer deletion requests through the Delete Request and Opt-out Platform (DROP). Additionally, the California Attorney General's office recently settled with a mobile app gaming company for $1.4 million due to non-compliance with CCPA opt-out requirements, particularly concerning the sale of minors' information without consent. The settlement includes implementing opt-out and opt-in consents and mandates compliance monitoring for three years.
Why It's Important?
The intensified enforcement by California's privacy agency underscores the state's commitment to protecting consumer data privacy. This move is significant for businesses operating in California, as it highlights the increasing regulatory scrutiny and potential financial penalties for non-compliance. The establishment of the Data Broker Enforcement Strike Force signals a proactive approach to addressing privacy concerns, particularly in the data broker industry, which has been criticized for potential misuse of personal information. The settlement with the gaming company serves as a cautionary tale for other businesses, emphasizing the importance of having robust opt-out processes and compliance measures in place. This development could influence other states to adopt similar stringent privacy regulations, potentially leading to a more uniform national standard.
What's Next?
As the Delete Act comes into effect in 2026, businesses, especially data brokers, will need to ensure compliance with the new requirements to avoid penalties. The ongoing monitoring of the gaming company's compliance may set a precedent for future enforcement actions. Additionally, California's opposition to federal attempts to limit state AI regulations suggests a potential legal and political battle over state versus federal authority in privacy matters. Companies should prepare for possible changes in the regulatory landscape and consider enhancing their privacy practices to align with California's stringent standards.
