California Brings First CCPA And Delete Act Enforcement Action Against Data Broker

The Highlights

1. California Expands Data Broker Enforcement Under the CCPA and Delete Act: California regulators brought their first enforcement action against a data broker under both the CCPA and the Delete Act, signaling increased scrutiny of businesses that collect and sell personal information without a direct consumer relationship.
2. Data Minimization Applies to Consumer Rights Requests: The decision makes clear that businesses cannot require consumers to provide more personal information than reasonably necessary to exercise their privacy rights. Regulators specifically challenged the collection of partial social security numbers in the opt-out process.
3. Companies Should Streamline Privacy Rights Requests: Consumers should be able to exercise their privacy rights through straightforward, low-burden processes.