The California privacy regulator recently settled with a data broker (Key Marketing Advantage LLC) that it alleged had violated the state’s data broker law. Under the Delete Act, data brokers must, among other things, register annually by January 31 and pay an annual fee. According to the agency, the company failed to register or pay the fee. The broker agreed to pay $55,800 as part of the settlement.

This settlement follows an industry investigation sweep the agency announced in October of last year, after which it reached similar settlements with other data brokers. For those keeping track, the agency focused on data broker compliance at the beginning of last year as well.

What’s coming up next for data brokers? The Act will require companies to access an online portal once every 45 days for consumer deletion requests. The portal is aptly called the Data Broker Delete Requests and Opt-Out Platform, or the DROP. It will launch to consumers on January 1, 2026. It opens to data brokers on August 1, 2026. As a reminder, Vermont, Texas, and Oregon also have similar data broker registration requirements.

Putting it Into Practice: This settlement is a reminder that California, like other states, is focused on entities that collect and sell personal information about individuals with whom they do not have a relationship (i.e., data brokers). If engaged in these practices keep the law’s requirements in mind.