California's privacy regulator has fined 8 data brokers a combined $385,400 since November 2024 for failing to register under the state's Delete Act, according to enforcement announcements the California Privacy Protection Agency (CPPA) has published through January 2026. Every case so far shares the same root cause: a company that met the legal definition of a data broker and did not register or pay its annual fee on time. No CPPA data broker fine to date has been based on how the company used the data it collected.
How much has the CPPA fined data brokers so far?
$385,400 is the running total across the 8 CPPA data broker enforcement cases confirmed between November 2024 and January 2026. That figure is PrivacyTerms.io's own sum of each individually announced fine; the CPPA does not publish one consolidated running total on its site, so this number is compiled directly from the agency's own case-by-case announcements. The cases span a Texas list broker selling health and political data, a New York financial data firm that missed the deadline through an internal error, and a marketing firm that built audience segments without ever registering.
Figure 1: The CPPA has collected $385,400 in data broker fines across 8 cases since November 2024. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
That total sits against a much larger backdrop. California's own data broker industry runs into the billions in annual revenue, which puts $385,400 in perspective: it is a meaningful signal that the state is enforcing its registry, not a figure that comes close to matching the scale of the industry it is policing.
Which CPPA data broker fines are the largest?
S&P Global's $62,600 penalty from January 2026 is the largest confirmed CPPA data broker fine to date, followed by ROR Partners LLC at $56,600 in December 2025 and Accurate Append at $55,400 in July 2025. The smallest confirmed fine is $34,400, against UpLead LLC in November 2024, part of the very first pair of cases the agency brought under the Delete Act.
Figure 2: All 8 confirmed CPPA data broker fines, ranked by amount. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
The spread between the largest and smallest fine is narrow, just $28,200, which suggests the CPPA is applying a fairly consistent penalty formula tied to how many days a company operated unregistered rather than scaling fines to company size. S&P Global is a multinational financial data provider; UpLead is a small business-to-business contact database vendor. Both paid within the same rough band.
How much did data broker fines total each year?
Data broker fines totaled $69,800 in 2024, across the 2 cases the CPPA settled that November, then jumped to $208,000 across 4 cases in 2025. The 2 cases confirmed so far in 2026 already total $107,600, on pace to match or exceed 2025's total well before the year is out.
Figure 3: Total CPPA data broker fines by year. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
More than 700 businesses have joined the California data broker registry, yet only 8 have been fined for failing to do so, which means the agency's enforcement sweeps have so far caught a small fraction of the companies that ever fall out of compliance for a period of time.
If your business collects information about people who are not your customers and shares any part of it with others, an accurate privacy policy generator built for CCPA and the Delete Act helps confirm whether your data-sharing disclosures already describe a data broker relationship before a regulator makes that determination for you.
How fast is data broker enforcement accelerating?
The CPPA's data broker enforcement has moved from an occasional sweep to a standing operation. Cumulative fines crossed $100,000 within 4 months of the first cases in November 2024, passed $200,000 by mid-2025, and reached $385,400 by January 2026, the month the agency's newly formed Data Broker Enforcement Strike Force brought its second and third cases in the span of 5 weeks.
Figure 4: Cumulative CPPA data broker fines since the first cases in November 2024. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
Nearly 6 months separated the first cases from the second round in early 2025. By the end of 2025, new cases were arriving roughly every 6 to 8 weeks, which is the clearest sign the agency treats data broker registration as an active, ongoing compliance sweep rather than a one-time cleanup effort.
How much of all data broker fines comes from one case?
S&P Global's $62,600 penalty accounts for 16.2% of every dollar the CPPA has collected in data broker fines since November 2024, more than any other single case. The remaining 7 cases combined make up the other 83.8% of the $385,400 total.
Figure 5: S&P Global's single fine against the combined total of the other 7 cases. Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io.
Unlike the largest CCPA settlements, where one outlier case can dominate the total, no single data broker fine here comes close to reshaping the overall picture the way it does in other enforcement areas. The 8 cases are close enough in size that removing any one of them changes the average by only a few thousand dollars.
What are all 8 CPPA data broker fines to date?
| Company | Fine | Date | Violation |
|---|---|---|---|
| S&P Global, Inc. | $62,600 | Jan 2026 | Failed to register by deadline, cited as an administrative error |
| ROR Partners LLC | $56,600 | Dec 2025 | Sold audience segments without registering |
| Accurate Append, Inc. | $55,400 | Jul 2025 | Failed to register or pay the 2023 annual fee |
| Background Alert, Inc. | $50,000 | Feb 2025 | Failed to register, ordered to halt operations through 2028 |
| Jerico Pictures, Inc. (National Public Data) | $46,000 | May 2025 | Registered 230 days after the deadline |
| Rickenbacher Data LLC (Datamasters) | $45,000 | Jan 2026 | Failed to register while selling health and political data lists |
| Growbots, Inc. | $35,400 | Nov 2024 | Failed to register for 177 days |
| UpLead LLC | $34,400 | Nov 2024 | Failed to register for 172 days |
| Total (8 cases) | $385,400 | Nov 2024 to Jan 2026 | -- |
Source: California Privacy Protection Agency enforcement announcements, compiled by PrivacyTerms.io. See our companion piece on the CPPA's Data Broker Enforcement Strike Force for a closer look at the ROR Partners case and what triggered it.
Every case in this list was avoidable with a $6,000 annual registration fee and a form filed on time. None of the 8 companies were fined for misusing the personal information they collected, only for not telling California they were collecting and selling it in the first place.
The Bottom Line
$385,400 across 8 cases is still a small number next to the size of the data broker industry itself, but the direction is what matters. Fines roughly tripled from 2024 to 2025, a dedicated strike force is now bringing cases every 6 to 8 weeks, and the CPPA has shown it will pursue small marketing firms and multinational financial data providers with the same enforcement formula. If your business collects or shares information about people who are not your direct customers, even as part of a broader product or analytics service, that activity may meet California's statutory definition of a data broker regardless of what your own marketing calls it. Given that a typical consumer's personal data is worth roughly $57 a year to the companies that buy and sell it, the incentive to keep collecting that data quietly, without registering, is not going away on its own.
Frequently Asked Questions
How much has the CPPA fined data brokers so far? $385,400 across 8 confirmed cases, according to California Privacy Protection Agency enforcement announcements published between November 2024 and January 2026, all for failing to register as a data broker under the state's Delete Act.
What is the average CPPA data broker fine? $48,175 per case, averaged across all 8 confirmed CPPA data broker enforcement actions, though individual fines range from $34,400 against UpLead LLC to $62,600 against S&P Global.
What is the largest CPPA data broker fine to date? $62,600, issued against S&P Global in January 2026 after the company failed to register as a data broker by the statutory deadline due to what the CPPA described as an administrative error.
Do all CPPA data broker fines come from the same type of violation? Yes. All 8 confirmed cases, 100% of them, involve the identical underlying violation: failing to register as a data broker and pay the required annual fee on time, not misuse of the data itself.
Where the Numbers Come From
- California Privacy Protection Agency. (2026). "CalPrivacy Brings New Round of Enforcement Actions Against Data Brokers." January 8, 2026 announcement covering the $45,000 Datamasters fine and $62,600 S&P Global fine.
- California Privacy Protection Agency. (2025). "CalPrivacy Fines Marketing Firm for Selling Custom Audiences Without Data Broker Registration." December 3, 2025 announcement of the $56,600 ROR Partners LLC fine.
- California Privacy Protection Agency. (2025). "Washington Data Broker Agrees to Pay Fine for Failing to Register." July 29, 2025 announcement of the $55,400 Accurate Append fine.
- California Privacy Protection Agency. (2025). "CPPA Orders Florida Data Broker to Pay Fine." May 8, 2025 final order of the $46,000 Jerico Pictures (National Public Data) fine.
- California Privacy Protection Agency. (2025). "Data Broker Promoting Ability to Dig Up 'Scary' Amounts of Information Agrees to Shut Down." February 27, 2025 announcement of the $50,000 Background Alert settlement.
- California Privacy Protection Agency. (2024). "CPPA Settles With First Set of Data Brokers." November 14, 2024 announcement of the $35,400 Growbots and $34,400 UpLead fines, the agency's first data broker enforcement actions.
- Electronic Frontier Foundation. (2025). "Why Are Hundreds of Data Brokers Not Registering with States?" Analysis of state registry data collected in early April 2025, covering California, Texas, Oregon, and Vermont.
Note: All figures verified as of October 2026. The $385,400 total and 16.2% share figures in this post are PrivacyTerms.io's own calculations, summed directly from each individual CPPA enforcement announcement listed above, since the agency does not publish one running total. Data broker enforcement figures are refreshed at least twice a year as the CPPA discloses new cases.
