United States of America: California Privacy Protection Agency established Data Broker Enforcement Strike Force

On 19 November 2025, the California Privacy Protection Agency (CalPrivacy) established the Data Broker Enforcement Strike Force within its Enforcement Division to investigate privacy violations by the data broker industry. The Enforcement Division will review compliance with the data broker registration requirement in the Delete Act and with the California Consumer Privacy Act (CCPA). The Strike Force builds upon the 2024 investigative sweep into data broker compliance with the Delete Act’s registration requirement, which produced a record number of enforcement actions and remains ongoing, and it introduces additional resources for further investigations. The Delete Act requires data brokers to register and pay an annual fee to fund the California Data Broker Registry and to fund the Delete Request and Opt-Out Platform (DROP), a deletion mechanism that will allow consumers to direct all data brokers to delete their personal information in a single request, with DROP scheduled to be available in January 2026.