New Advisory Warns B2B Firms: Avoid Unintentional Data Broker Status
CalPrivacy warns B2B firms about inadvertent data broker classification risks under the Delete Act.
Why it matters: Legal teams need to reevaluate their data practices as unintentional misclassification can lead to heavy fines. Compliance failures can cost tens of thousands and disrupt business operations.
- California’s Delete Act requires data brokers to register with $200/day fines for inaccurate info.
- CalPrivacy issued Enforcement Advisory 2026-01 on Sept 3 emphasizing strict registration accuracy.
- Datamasters fined $45,000 in Jan 2026 and ROR Partners fined $56,600 in Dec 2025 for failing to register.
- Four states—California, Texas, Oregon, Vermont—mandate data broker registrations as of 2026.
On September 3, 2026, the California Privacy Protection Agency (CalPrivacy) issued Enforcement Advisory 2026-01, highlighting the risks for businesses that fail to correctly register as data brokers under the California Delete Act.
The Delete Act mandates that data brokers must register with the state and keep their registration information accurate. Failure to do so can result in fines of $200 per day for inaccuracies. Importantly, the advisory states the law does not differentiate between unintentional mistakes and intentional misrepresentation; both lead to penalties.
This creates emerging compliance challenges for B2B enterprises that manage business data and may unknowingly meet the definitions of a data broker. Recent enforcement actions underline this risk: Datamasters (Rickenbacher Data LLC) was fined $45,000 in January 2026, and ROR Partners paid $56,600 in December 2025, both for failing to register.
Beyond California, three other states—Texas, Oregon, and Vermont—also require data broker registration, expanding the regulatory landscape as of 2026 (recordinglaw.com).
Legal and compliance teams at B2B firms should carefully analyze their data collection and handling activities to determine whether they qualify as data brokers. Revisiting internal data practices and registration status can prevent costly regulatory actions and maintain operational integrity.
By the numbers:
- $200 per day — fines in California for inaccurate data broker registration
- $45,000 — fine for Datamasters in January 2026 for failing to register
- $56,600 — fine for ROR Partners in December 2025 for failing to register
- 4 states — require data broker registration as of 2026 (CA, TX, OR, VT)