California Privacy Protection Agency issues enforcement advisory for Delete Act compliance
On December 17, the California Privacy Protection Agency (CalPrivacy) issued Enforcement Advisory No. 2025-01, clarifying that under California’s Delete Act, businesses that operated as data brokers in the prior year must register with the agency by January 31, disclose all trade names and website addresses through which they provide services, and pay an annual fee to support the Data Broker Registry and forthcoming Delete Request and Opt-Out Platform (DROP) (previously covered by InfoBytes here). Once available, on January 1, 2026, DROP will enable consumers to direct all registered data brokers to delete their personal information with a single request. In addition to paying registration fees and any expenses the agency incurs in enforcing violations of the law against them, data brokers that fail to register would also face administrative fines of $200 per day for each day they remain unregistered.