By now, most ad tech professionals should be familiar with California’s data broker registration requirements under the Delete Act.
Any entity that is a “business,” as defined by the California Consumer Privacy Act (CCPA), and that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, must register with the California Privacy Protection Agency (CPPA) as a data broker.
Failing to properly register will soon become an existential threat for ad industry participants who qualify as data brokers under the new law.
The CPPA has built and is in the process of rolling out the Delete Request and Opt-Out Platform (DROP). California consumers will be able to submit to the DROP their personal information that they wish registered data brokers to delete. Data brokers will need to access the DROP and process those consumer requests through an automated or manual process every 45 days starting August 1, 2026, or face heavy fines.
Enter the DROP
Previously, California’s data broker registry simply consisted of a list of registered data brokers with links to their privacy disclosures and opt-out processes. If a consumer wished to have their data deleted by the hundreds of registered data brokers, it would take the consumer days, if not weeks, to do so. The consumer would have to review each individual data broker’s website and follow each company’s unique opt-out process.
But the CPPA is shortening the deletion request process to a few minutes.
The DROP opened to Californians on January 1 of this year, and it is estimated that over 250,000 people have already registered. The CPPA is planning a big registration push this summer, with the expectation that the number of registered consumers could reach 1,000,000 Californians by August 1.
From manageable fines to existential risk
Currently, the CPPA has the authority to impose a fine of $200 for each day that a data broker fails to register as required by the Delete Act. Not an exorbitant amount, but fines could add up to $73,000 a year for failing to register, so it is not insignificant.
However, starting August 1, the potential fines will increase significantly. A data broker that fails to comply with the DROP after this date could be subject to a fine of $200 per day per deletion request it fails to honor.
By way of example, if there are 1,000,000 Californians registered on August 1 who request that a data broker delete any of their personal information held by the business, and the data broker fails to do so when required for even one day, the fine could be $200 million!
This is like using a bazooka to destroy an anthill.
Think you’re not a data broker? Think again.
The definition of data broker is quite broad under the Delete Act, and many in the ad industry may not realize they could meet the criteria.
A business may be a data broker if it knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.
The CPPA recently clarified that a “direct relationship” only exists if the consumer has “intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting or obtaining information about the business’s products or services.”
To reiterate: A business does not have a direct relationship simply because it collected personal information directly from the consumer.
This clarification may have significant implications for the ad tech industry. When a consumer accesses a website with numerous third-party pixels firing in the background, one could argue that the consumer has not intentionally interacted with those pixel providers.
Preparing for compliance
Since the DROP and its processes are the first of its kind, registered data brokers will soon have a way to test the system.
The CPPA will provide data brokers with access to a sandbox, which will include technical implementation guidelines and the ability to build and test a business’s integration with the DROP.
While implementation may take some time, it certainly sounds far better than paying hundreds of millions of dollars in fines.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow Gary Kibel, Davis+Gilbert LLP and AdExchanger on LinkedIn.
For more articles featuring Gary Kibel, click here.
