Cybersecurity Policy Report, Second Data Broker Fined Over Failure to Register in California, (Aug 13, 2026)

By Tony Foley

The California Privacy Protection Agency (CalPrivacy) announced today that it had fined another data broker for failing to timely register with the agency’s data broker registry.

In its announcement today, CalPrivacy said that Cybba, Inc., a Boston-based data broker that sells personal information, including geolocation and Internet activity data, and provides signals from consumers’ purchasing behaviors to identify potential repeat customers and others who are more likely to make purchases. The company carried out these data broker activities in 2024, but when required to register with CalPrivacy by Jan. 31, 2025, under the DELETE Act, failed to do so. Accordingly, the agency fined Cybba $52,400. The decision further requires Cybba to post metrics about privacy rights on its website, access the Delete Request and Opt-out Platform (DROP) as necessary moving forward, and process further deletion requests through the platform.

Michael Macko, CalPrivacy’s head of enforcement, signaled that the agency’s enforcement activities will continue apace. “CalPrivacy has been bringing a steady drumbeat of enforcement actions under both the Delete Act and the CCPA, and I don’t see the enforcement activity slowing down anytime soon,” he said. “Especially with the launch of DROP, businesses should take a close look at their activities.”

The latest fine comes days after CalPrivacy fined LocateSmarter LLC $116,490 both for failing to register as required by the DELETE Act and for unlawfully requiring Californians to provide a partial Social Security number prior to exercising their opt-out rights in violation of the California Consumer Privacy Act (CPR, Aug. 11).

News: StateLegislation LitigationEnforcement DataPrivacy