On November 18, 2025, the California Privacy Protection Agency (CPPA) announced the formation of a new Data Broker Enforcement Strike Force within its Enforcement Division. The purpose of this new team is to investigate alleged violations of both the California Consumer Privacy Act (CCPA) and the Delete Act’s data broker registration requirements.

According to the CPPA, the Strike Force will:

• Expand review and oversight of the data broker industry;
• Support the implementation of the forthcoming Delete Request and Opt-Out Platform; and
• Ensure that data brokers comply with registration and consumer deletion request rules under the Delete Act and CCPA.

A key development beginning in January 2026, the Delete Request and Opt-Out Platform will allow consumers to submit a single deletion request that will be sent to all registered data brokers at once, greatly simplifying the process for individuals seeking to exercise their privacy rights.

This announcement follows the 2024 investigative sweep targeting data broker compliance, which, according to the CPPA, has already resulted in a significant number of ongoing enforcement actions. The creation of the Strike Force is intended to provide additional resources and focus for those efforts, ensuring continued and increased scrutiny of data brokers’ compliance with registration, transparency, and consumer-rights obligations.

California is cementing its role as a leader in state-level privacy enforcement, with the Strike Force representing yet another expansion of oversight and enforcement tools. Other states are likely to watch California’s model carefully and may establish similar specialized units or requirements.

Consider these practical steps for your business to stay out of the path of this new enforcement arm:

• Proactive Compliance: Organizations subject to the CCPA or Delete Act should review their compliance programs, particularly data broker registration status and procedures for responding to consumer deletion requests;
• Monitoring Developments: Companies operating in multiple states should pay close attention to evolving state-level privacy laws and enforcement trends, as similar requirements may take shape outside of California; and
• Readiness for the 2026 Platform: Preparation for the Delete Request and Opt-Out Platform should begin now, to ensure technical and process readiness when the platform goes live.

California’s ongoing focus on data broker regulation and consumer privacy rights means that enforcement is likely to intensify, not just through the courts, but via proactive monitoring and investigation. The creation of the Data Broker Enforcement Strike Force underscores the importance of robust privacy compliance in today’s rapidly evolving legal landscape. Now is the time to evaluate your privacy practices and make sure that they meet California’s rigorous and expanding standards.