United States of America: Announced CPPA investigations into Data Broker Compliance under the Delete Act (SB 362)

On 30 October 2024, the California Privacy Protection Agency (CPPA) announced an investigation into data brokers' compliance with the registration requirements of the Delete Act. The Act requires data brokers, defined as businesses that collect and sell consumers' personal information without direct interaction, to register with the CPPA and pay an annual fee. Specifically, data brokers must register with the CPPA by 31 January if they operated in the previous year or face penalties of USD 200 per day for non-compliance. The Act also requires data brokers to disclose consumer deletion requests, their response times, and the specific types of data they handle, such as minors and geolocation data. In addition, data brokers will be required to participate in the Data Broker Requests and Opt-Out Platform (DROP) by 2026, which will allow consumers to delete personal information across brokers with a single request.