California Privacy Regulator Warns Data Brokers Over Incomplete Registry Disclosures
The California Privacy Protection Agency (CPPA) published an enforcement advisory in late 2025, warning that some data brokers may not be disclosing all of their trade names or associated websites on the state's mandatory registry — a gap the agency says makes it difficult for consumers to identify who actually holds their personal information, according to reporting from the IAPP.
The advisory specifically states that brokers must comply and register independently, rather than relying on a parent company's or affiliate's registration to cover their own operations — closing a loophole that critics said allowed some brokers to effectively remain invisible on the public registry despite operating in the state.
The warning comes as California expands its broader data broker oversight regime in 2026, including new registration and disclosure requirements that took effect August 1 and the ongoing rollout of the centralized DROP deletion platform under the state's Delete Act.
Privacy advocates have welcomed the increased scrutiny, arguing that an incomplete or fragmented registry undermines the practical value of consumer opt-out and deletion rights, since consumers can't request removal from a broker they don't know exists.
For steps on protecting yourself regardless of registry completeness, see our guide on how to opt out of data brokers.
Source: IAPP.