On November 14, 2024, the California Privacy Protection Agency (“CPPA”), which is tasked with enforcing the California Consumer Privacy Act (the “CCPA”), announced it settled with two data brokers, Growbots, Inc. and UpLead LLC, for failing to register and pay required fees under Senate Bill 362, also known as the Delete Act. The companies will each pay fines—$35,400 for Growbots and $34,400 for UpLead—and agree to cover the CPPA’s legal costs for violations that occurred between February and July 2024.
The Delete Act, signed into law in 2023, mandates that data brokers register with the CPPA and pay an annual fee to fund the California Data Broker Registry. The Delete Act imposes fines of $200 per day for failing to register by the deadline. The registration fees are used to fund efforts like the development of the Data Broker Requests and Opt-Out Platform (“DROP”), which is a first-of-its-kind deletion mechanism that will allow consumers to request data deletion from all brokers with a single action. The CPPA expects that DROP will be available to consumers in 2026 via the CPPA website.
These recent settlements, in addition to newly adopted regulations by the CPPA (which further clarify data broker registration requirements under the Delete Act and require data brokers to disclose specific information about their exempt data collection practices) highlight the CPPA’s continued focus on the privacy practices of data brokers.