Cybersecurity Policy Report, More Data Broker Sanctions Issued by CalPrivacy, (Jan 9, 2026)
Organizations Mentioned:S&P Global
By Tony Foley
The California Privacy Protection Agency (CalPrivacy) yesterday announced that it had issued the latest in a series of fines against data brokers based on failure to register in violation of the California DELETE Act.
Rickenbacher Data LLC. CalPrivacy fined Rickenbacher Data LLC, d/b/a Datamasters, a Texas-based reseller of personal information for targeted advertising, $45,000 based on its failure to register as a data broker and ordered the company to stop selling all Californians’ personal information.
The decision said Rickenbacher bought and resold the names, addresses, phone numbers, and e-mail addresses of millions of people with Alzheimer’s disease, drug addiction, bladder incontinence, and other health conditions for targeted advertising. In addition, the company bought and resold lists of people based on age and perceived race, as well as lists based on political views, grocery store purchases, banking activity, and health-related purchases.
CalPrivacy noted that its order would effectively remove Rickenbacher from the California marketplace. “Reselling lists of people battling Alzheimer’s disease is a recipe for trouble,” said Michael Macko, CalPrivacy’s head of enforcement. “In the wrong hands, these lists could be used to target people for more than just advertising. The same risks apply to selling lists of seniors, people who identify as conservative or liberal, or people who purchase sensitive health products. History teaches us that certain types of lists can be dangerous.”
S&P Global. In a separate decision, CalPrivacy fined New York-based data and technology provider S&P Global, Inc., $62,600 for its failure to register as a data broker due to an administrative error. In addition, the decision requires S&P Global to adopt procedures for registration and compliance auditing to prevent similar errors in the future.
In addition to announcing the fines, CalPrivacy also encouraged Californias to sign up for the Delete Request and Opt-out Platform (DROP), a deletion mechanism that allows consumers to direct all data brokers to delete their personal information in a single request. “Californians have a clear way to push back and regain control now that CalPrivacy’s DROP system is live,” said Tom Kemp, the agency’s executive director. “If you are concerned about data brokers selling your personal information, I highly recommend that you sign up for DROP.”
News: StateLegislation LitigationEnforcement DataPrivacy CCPA