California continues its mission to ramp up enforcement of privacy regulations implemented under the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA).
Data Broker Enforcement Strike Force
CalPrivacy created a new division in its enforcement team geared towards ensuring compliance with privacy regulations in the data broker industry. CalPrivacy plans to use this strike force to ensure data brokers comply with the CCPA as well as with the new requirements under the Delete Act, which goes into effect January 1, 2026. Under the Delete Act, data brokers are required to register and pay a fee, plus comply with deletion requests that consumers submit in the Delete Request and Opt-out Platform (“DROP”). These new requirements, in tandem with the strike force, are designed to quell concerns over data brokers’ potential misuse of Californians’ personal information.
Settlement for Improper Opt-Outs
The California Attorneys’ General also recently entered into a settlement with a mobile app gaming company for $1.4 million in civil penalties for failure to have proper opt-outs on its website or on its apps. The CCPA has certain requirements for opt-outs for the sale of an individual’s information. Since the opt-out process in both the gaming company’s apps and website were not CCPA compliant, this created issues, especially since that company sold the information of minors without prior consent. Under the CCPA, there are additional regulations to protect minors, including opt-in requirements.
Outside of the penalties, the settlement required the gaming company to implement some compliance measures. It must implement opt-out consents for the general population, as well as opt-in consents for minors. For the next three years, the gaming company is required to continue monitoring its compliance with these regulations.
A major takeaway is that companies need to configure their opt-out process to be easy, effective, and simple for consumers.
Other Efforts
Not only is CalPrivacy seeking to enforce privacy regulations, but it is also trying to protect California’s regulations by actively opposing federal attempts to limit state AI regulations. This includes opposing federal efforts to pause state regulations on the use of advanced decision-making technology (ADMT). California’s ADMT regulations were put in place to further protect the privacy rights of individuals, which could impact how employers run their operations.
