The California Privacy Protection Agency Board has issued a decision requiring Cybba Inc., a Boston-based data broker, to pay a fine of $52,400 for violating the state’s Delete Act. The company failed to register in time and sold Californians’ personal information without their permission.

Background

The Delete Act, also known as California’s Civil Code § 1798.99.82(a), requires data brokers to register with the state and obtain consent from consumers before selling their personal information. Cybba Inc. sells personal information, including geolocation data, internet activity data, and commercial data, through products designed to help digital marketing target custom audiences.

The California Privacy Protection Agency Board found that Cybba Inc. had sold products that included the personal information of Californians without registering with the state regulator. The company has since registered late as a data broker, cooperated with the state regulator’s investigation, and registered in time for its activities in 2025.

Consequences

Data brokers that fail to register with the state regulator face a $200 per day enforcement cost, in addition to a $200 per day, per consumer cost for failing to delete private information. The California Privacy Protection Agency Board has been actively enforcing the Delete Act and the California Consumer Privacy Act (CCPA), with a focus on protecting consumers’ personal information.

The recently launched Delete Request and Opt-out Platform (DROP) gives Californians more control over their digital data and who gathers and sells it. The platform allows consumers to upload their unique device identifiers and request that data brokers delete their personal information.

Original reporting: KEYT (Ventura/Santa Barbara) — read the source article.