1,550% Price Increase for Data Brokers Registering with CPPA in California

Nov 18

3 min read

tl;dr -

California's annual registration fee has jumped 1,550% from $400/yr to $6,600/yr
California clarified a "Minor" is someone age 15 or under
A business selling about their own users is now a Data Broker if they are selling data not given to them directly by the user

The California Privacy Protection Agency (CPPA) - voted on November 8th to adopt a slew of new rules for Data Brokers. Here's the most important points:

The annual registration fee is now 1,550% higher at $6,600 per year

As a rather last minute item added to the public hearing, a proposal to increase the registration fees was added to the agenda only one week prior to the vote.

The proposal suggests that the CPPA underestimated the amount needed to build their upcoming Delete Request and Opt-out Platform ("DROP") System and recommended raising the annual registration fee from $400/yr to $6,600/yr.

If all 527 Data Brokers registered with the CPPA were to re-register and pay the new fee (which is unlikely given the number of Data Brokers trying to change business practices attempting to avoid this regulation), the CPPA could bring a cool nearly ~$3.5MM by the end of January.

Opinion: I think this change in fees is going to discourage Data Brokers from registering and ultimately hurt consumer's privacy. Several other private apps provide the same functionality of removing your data from Data Brokers via opt-out requests, but most of them rely of California's database of Data Brokers to do so. The CPPA should focus on bringing more Data Brokers into the light, and less on punishing those that are willingly compliant.

Selling ANY 2nd or 3rd party data makes you a Data Broker

The CPPA clarified that;

"A business is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business did not collect directly from the consumer."

They further clarify the definition of Direct Relationship:

“Direct relationship” means that a consumer intentionally interacts with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services within the preceding three years.

Subsidiaries and Parent Companies must register separately

Already, much of the CPPA Data Broker registry is filled with the many arms of Alphabet and Meta, but now there's clarity that others must follow suit.

A business, regardless of its status as a parent company or subsidiary of another business, which independently meets the definition of “data broker” for any period of time during the previous calendar year must register with the CPPA.

Businesses also have to disclose all of the DBAs.

A Minor is defined as 15 and younger

Also of note is that businesses that willfully disregard the consumers' age will be treated as if they know the age of the consumer.

The Registration Period is officially Jan 1-31

Previously the law specified that the end of the registration period is Jan 31, but now there is clarity that the beginning of the registration period is the first of the month.

Enforcement

Almost immediately following this update, the enforcement division of the CPPA announced its first 2 settlements with Data Brokers who failed to register by the deadline of Jan 31st 2024.

Growbots will pay $35,400 to resolve the Enforcement Division’s claims that the company failed to register between February 1 and July 26, 2024.

UpLead will pay $34,400 to resolve the Enforcement Division’s claims that the company failed to register between February 1 and July 21, 2024.

In addition to the fines, both companies agreed to injunctive terms, including agreeing to pay the Enforcement Division’s attorney fees and costs resulting from any non-compliance.

It seems like the CPPA is responding to the anti-regulation rhetoric at the federal level by taking a stand towards enforcement at the state level. Given the economic weight California has to throw around, we can like expect more big moves from the golden state.