California Privacy Protection Agency shuts down data brokerage through Delete Act enforcement

The California Privacy Protection Agency (“CPPA”) has moved forward with an enforcement action and settlement with two data brokers resulting from its investigative sweep of data broker registration compliance under the California Delete Act. Under the Delete Act, data brokers that operated in 2023 were required to register by Jan. 31, 2024, with the CPPA. Data brokers who failed to register could face fines of $200 per day.

The first enforcement action occurred on Feb. 20, 2025, and was brought against a Florida-based data broker named Jerico Pictures, Inc., doing business under the name National Public Data (“NPD”). The CPPA alleged that NPD did not register as a data broker until Sept. 18, 2024, a full 230 days after the Jan. 31, 2024 deadline. NPD had suffered a data breach in 2024 that resulted in the exposure of 2.9 billion records. The CPPA further alleged that NPD did not register until after being contacted by the CPPA’s enforcement division during an investigation. As a result, the CPPA is seeking a fine of $46,000 for failing to timely register as a data broker.

The second action occurred on Feb. 27, 2025, when the CPPA reached a settlement with Background Alert, Inc., related to allegations that the entity operated as a data broker and failed to timely register between Feb. 1 and Oct. 8, 2024. Background Alert is a California-based data broker that collected billions of public records, drew inferences from the records collected, identified potential associations between individuals, and identified patterns to create profiles about consumers that it then sold online through its website. Under the settlement agreement, Background Alert must cease its operation in 15 days and is prohibited from continuing its operations for three years through 2028. If Background Alert fails to cease its operations in a timely manner it will face a $50,000 fine.

These actions demonstrate that the CPPA is actively enforcing the Delete Act and using all available actions while doing so. Data brokers need to heed the multiple obligations created or modified under the Delete Act. This includes amendments to the existing Data Broker Registration law requiring data brokers to timely register with the CPPA.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.