The California Privacy Protection Agency has brought at least 11 confirmed enforcement actions against unregistered data brokers since November 2024, collecting $542,000 in disclosed fines and penalties, according to the agency's own enforcement announcements published through January 2026. That figure covers only cases with a named company and a stated dollar amount; the agency's own count of matters it has opened runs higher.
That total sits almost entirely outside the CCPA settlements most privacy coverage focuses on, and it comes from a law most businesses have never heard of.
How many enforcement actions has the CPPA brought against data brokers?
At least 11 confirmed enforcement actions have been publicly announced between November 14, 2024 and January 8, 2026, each against a company the CPPA found had failed to register as a data broker under California's Delete Act. Every case follows the same pattern: a company sold or transferred personal information about California residents to third parties without registering and paying the state's annual data broker fee, and the CPPA's Enforcement Division opened a case after the registration deadline passed.
Figure 1: The 8 largest of 11 confirmed CPPA data broker fines. Source: California Privacy Protection Agency enforcement announcements, November 2024 through January 2026.
The companies span the full range of the data broker industry: marketing firms that resold custom audience segments, background-check sites, and even a Fortune 500 financial data provider. Most registered only after the Enforcement Division contacted them directly during an investigation, which the agency's fine orders note repeatedly.
What is the largest fine the CPPA has issued against a data broker?
$62,600 is the largest confirmed fine, paid by S&P Global in January 2026 after the company failed to register as a data broker in California. The CPPA's own announcement attributed the lapse to an administrative error rather than a deliberate attempt to avoid registration, which makes it a useful data point: even a large, compliance-staffed public company missed this filing. The next case named the same month, Rickenbacher Data LLC (doing business as Datamasters), was fined $45,000 for reselling names, addresses, and health-condition-linked lists on millions of people while unregistered.
Figure 2: Running total of confirmed CPPA data broker fines by settlement date. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
One of the 11 confirmed amounts carries a caveat worth stating plainly: Background Alert's $50,000 penalty is a suspended fine tied to a three-year shutdown agreement, payable only if the company resumes operations before 2028, not a sum the agency has necessarily collected. Excluding that one conditional case, the remaining 10 confirmed fines still total $492,000.
If your site collects or sells California residents' personal information in any form, a current, accurate privacy policy that discloses those practices is the first thing a regulator checks. A privacy policy generator built for CCPA and CPRA keeps that disclosure current without waiting for an investigation to flag the gap.
What is the Data Broker Enforcement Strike Force, and why did the CPPA launch it?
The CPPA launched a dedicated Data Broker Enforcement Strike Force on November 19, 2025, describing it as a specialized unit within the Enforcement Division built to investigate data broker industry violations of both the Delete Act's registration requirement and the CCPA itself. It is the agency's first enforcement unit organized around a single statute rather than general CCPA compliance, and the launch announcement cited nearly a half-dozen enforcement actions against unregistered data brokers in the months leading up to it.
Figure 3: Of the 13 enforcement actions the CPPA has brought directly under its own administrative authority, 11 target data broker registration failures and 2 target CCPA violations. Source: California Privacy Protection Agency enforcement announcements.
The imbalance is deliberate. The Delete Act gives the CPPA a straightforward violation to prove, a company either registered and paid its annual fee by the deadline or it did not, while most CCPA violations require a more involved factual investigation. Registration cases have become the agency's fastest, most repeatable enforcement tool.
How has the CPPA's enforcement authority evolved since 2022?
The CPPA did not always have independent enforcement power. Rulemaking authority transferred to the agency in 2022, but it could not bring its own enforcement cases until July 2023, when its CCPA rulemaking and enforcement authority formally began. The Delete Act, which created the data broker registry the agency now uses as its primary enforcement lever, was signed into law in October 2023, with the first registration deadline and its first wave of settlements following about a year later.
Figure 4: Key milestones in the CPPA's enforcement authority, from rulemaking transfer to its current data broker enforcement program. Source: California Privacy Protection Agency public announcements, 2022 to 2026.
Every data broker case in this post falls inside a narrow 15-month window, which means the agency's entire data broker enforcement track record is still less than two years old.
How does the CPPA's own enforcement differ from the Attorney General's CCPA settlements?
The two bodies bring different kinds of cases. The California Attorney General's office has brought most of the 13 confirmed CCPA monetary settlements, typically larger civil actions like the CCPA's record General Motors settlement covered in our companion post on average CCPA settlement size. The CPPA itself has used its own administrative authority to fine only 2 companies directly under CCPA, Tractor Supply and American Honda, while bringing far more, and generally smaller, cases against unregistered data brokers under a separate statute.
Figure 5: Which California authority typically brings a case depends on which statute was violated. Source: PrivacyTerms.io analysis of CPPA and California Attorney General enforcement patterns, 2022 to 2026.
For a full accounting of every confirmed CCPA settlement, not just the two the CPPA brought directly, see our companion breakdown of all 13 CCPA enforcement actions. Enforcement authority also varies by state; our tracker of US state privacy laws covers which states give their regulator this kind of direct administrative fining power versus routing everything through an attorney general.
Every confirmed CPPA data broker enforcement action
| Company | Fine | Violation | Date |
|---|---|---|---|
| S&P Global, Inc. | $62,600 | Registration failure (administrative error) | Jan 2026 |
| ROR Partners LLC | $56,600 | Registration failure | Dec 2025 |
| Key Marketing Advantage, LLC | $55,800 | Registration failure | Jan 2025 |
| Accurate Append, Inc. | $55,400 | Registration failure | Jul 2025 |
| Infillion (PayDae, Inc.) | $54,200 | Registration failure | Dec 2024 |
| Background Alert, Inc. | $50,000 | Registration failure, conditional shutdown fine | Feb 2025 |
| The Data Group, LLC | $46,600 | Registration failure | Dec 2024 |
| Jerico Pictures (National Public Data) | $46,000 | Registration failure | May 2025 |
| Rickenbacher Data LLC (Datamasters) | $45,000 | Registration failure | Jan 2026 |
| Growbots, Inc. | $35,400 | Registration failure | Nov 2024 |
| UpLead LLC | $34,400 | Registration failure | Nov 2024 |
| Total (11 confirmed cases) | $542,000 | -- | Nov 2024 to Jan 2026 |
Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
The Bottom Line
$542,000 across 11 confirmed cases is a modest total next to the California Attorney General's $24.9 million in CCPA settlements, but the pattern matters more than the dollar figure. The CPPA has turned data broker registration into a repeatable enforcement program, most cases follow the same script of a missed deadline followed by a fine after the agency makes contact, and the November 2025 Strike Force signals the agency wants to run more of these cases, not fewer. Any business that sells or shares personal information about California residents, even as a small part of a larger service, should confirm its registration status and keep its privacy policy's data-sale disclosures current before an investigation starts rather than after.
Frequently Asked Questions
How many enforcement actions has the CPPA brought against data brokers? At least 11 confirmed enforcement actions since November 2024, collecting a combined $542,000 in fines and penalties, according to the California Privacy Protection Agency's own published announcements through January 2026. The agency's January 2026 release also referenced more than 10 additional unregistered-data-broker matters beyond that count.
What is the largest fine the CPPA has issued against a data broker? $62,600, paid by S&P Global in January 2026 after the company failed to register as a data broker, which the CPPA attributed to an administrative error rather than a deliberate attempt to avoid registration.
Does the CPPA or the California Attorney General bring most CCPA cases? The Attorney General's office has brought most of the 13 confirmed CCPA monetary settlements. The CPPA has used its own administrative authority to fine only 2 companies directly under CCPA itself, Tractor Supply for $1.35 million and American Honda for $632,500, while bringing far more cases against unregistered data brokers under the Delete Act.
What triggered the CPPA's Data Broker Enforcement Strike Force? A wave of data broker registration cases built through 2025, and the agency formally launched the Strike Force on November 19, 2025, citing nearly a half-dozen enforcement actions against unregistered data brokers in the months before the launch.
Where the Numbers Come From
- California Privacy Protection Agency. (2026). "CalPrivacy Brings New Round of Enforcement Actions Against Data Brokers." January 8, 2026 announcement naming S&P Global and Rickenbacher Data, and referencing more than 10 additional unregistered-data-broker matters.
- California Privacy Protection Agency. (2025). "CalPrivacy Launches Data Broker Enforcement Strike Force." November 19, 2025 announcement, the source for the Strike Force launch and the case totals leading up to it.
- California Privacy Protection Agency. (2025). "CalPrivacy Fines Marketing Firm for Selling Custom Audiences Without Data Broker Registration." ROR Partners settlement, December 3, 2025.
- California Privacy Protection Agency. (2025). "CPPA Orders Florida Data Broker to Pay Fine." Jerico Pictures (National Public Data) settlement, May 8, 2025.
- California Privacy Protection Agency. (2024). "CPPA Settles With First Set of Data Brokers." Growbots and UpLead settlements, the first two confirmed cases, November 14, 2024.
- California Privacy Protection Agency. "Announcements." Full chronological index of every enforcement action, board update, and regulatory notice cited in this post.
Note: All figures verified as of September 2026, current through the CPPA's January 8, 2026 enforcement announcement. Data broker enforcement data is refreshed at least twice a year as the agency discloses new cases.
