On January 8, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced an enforcement action against Rickenbacher Data LLC (d/b/a “Datamasters”), an information reseller, for failing to register as a data broker under the California Delete Act.  Datamasters agreed to pay a $45,000 administrative fine, among other remedial measures.  In November, CalPrivacy launched a Data Broker Enforcement Strike Force within its enforcement division to investigate violations of the law in the data broker industry, which builds upon a 2024 investigative sweep into data broker compliance.

Datamasters Enforcement Action

CalPrivacy alleged that Datamasters bought and resold personal information for targeted advertising based on characteristics such as health conditions, ethnicity, age, and purchasing behaviors without registering as a data broker.  Although the order states that Datamasters told CalPrivacy it did not do business or take orders in California, CalPrivacy “perceiv[ed] an inconsistency” between these statements and representations on the company’s website.  Additionally, Datamasters represented to CalPrivacy that it received personal information of Californians but asserted that it rejected requests from customers to purchase California-specific personal information.  However, Datamasters allowed customers to purchase nationwide lists, and efforts to screen those lists for California consumers were “imperfect.”  CalPrivacy alleged that Datamasters lacked sufficient written policies and procedures to ensure compliance with the California Delete Act. In addition to paying a $45,000 administrative fine, Datamasters agreed to further remedial measures, such as permanent deletion of previously purchased personal information of California residents and the adoption and maintenance of written policies and procedures for a period of five years.  Datamasters also agreed to include clear disclosures on its website and contact forms stating that it does not buy or sell Californians’ data and to maintain records of certain transactions involving Californians’ data for five years, making those records available to CalPrivacy upon request.