United States of America: Privacy Protection Agency issued ruling against UpLead for non-compliance with registration requirements under Delete Act

On 8 November 2024, the California Privacy Protection Agency (CPPA) announced the settlement of its investigation into UpLead for failing to comply with the registration and fee payment requirements outlined in the Delete Act (SB 362). UpLead was fined USD 34,400 for not registering with the California Data Broker Registry by the required deadline. The Act requires data brokers, defined as businesses that collect and sell consumers' personal information without direct interaction, to register with the CPPA and pay an annual fee. Specifically, data brokers must register with the CPPA by 31 January if they operated in the previous year or face penalties of USD 200 per day for non-compliance. The Act also requires data brokers to disclose consumer deletion requests, their response times, and the specific types of data they handle, such as minors and geolocation data. In addition, data brokers will be required to participate in the Data Broker Requests and Opt-Out Platform (DROP) by 2026, which will allow consumers to delete personal information across brokers with a single request.